#1Tools for analyzing hard drives, SSDs, and other storage media to recover data and artifacts.
Kitploit recommended
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
libyal/libqcowLibrary and tools to access the QEMU Copy-On-Write (QCOW) image format
google/hashrBuilds forensic file hash sets from disk images, packages, and archives across GCP, AWS, and local sources, with deduplication and PostgreSQL/Spanner…
fboldewin/atmmalscanCommand-line DFIR tool for scanning Windows ATM systems to detect malware traces in process memory and disk, with automated memory dump creation for…
cherojeong/extundeleteUndelete and recover accidentally erased files from ext3 and ext4 filesystems, using inode scanning and block recovery for forensic and data-loss…
xchwarze/magic-extractorUniversal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.
appliedsec/forensicscannerForensic Scanner
fishermavis/bsod_bitlocker_recoverPython script for carving Bitlocker VMK keys
4n6ist/usn_analyticsIt's not just UsnJrnl (USN Journal Records/Change Journal Records) parser.
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
theevidencehunter/forensixDigital Forensics Intelligence Framework
synacktiv/veeam-velociraptorProof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.
gnu-mirror-unofficial/ddrescueCopies data from damaged or failing storage devices, handles read errors, and performs efficient rescue operations to recover as much data as…
ra3edaj/lab-dfir-cve-2023-38831d
yelparchive/osxcollectorA forensic evidence collection & analysis toolkit for OS X
