#1Digital forensics, evidence collection, timeline analysis, and incident investigation tools.
Kitploit recommended
onekey-sec/unblobExtract files from any kind of container formats
seekbytes/ipaGUI analyzer for deep-diving into PDF files. Detect malicious payloads, understand object relationships, and extract key information for threat…
seladb/pcapplusplusMultiplatform C++ library for high-performance network packet capture, parsing, crafting, and analysis. Supports libpcap, DPDK, AF_XDP, PF_RING, and…
gilnett/wstraceStandalone zero-driver Windows system and API monitor in Rust
karim852/kage-dfir-toolkitWindows host DFIR triage console that chains artefact collection, Sigma-correlated timelines, YARA scans, socket and account inspection, indicator…
ahmadhassan-bted/nasunoAI audio watermark removal & forensic anti-attribution toolkit. Neutralizes Suno, Udio, and neural fingerprints with ISO 226 perceptual masking.
gchq/cyberchefThe Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
nelenkov/android-backup-extractorExtract and repack Android ADB backups (ICS+). Supports encrypted archives, tar conversion, and standard I/O for forensic analysis or data recovery.
last-byte/persistencesniperPowershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.…
wrongbaud/spidumpTool for reconstructing SPI flash images via logic analyzer captures
qsecure-labs/deadmatterOffset Independent Credential Extraction Tool
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
zardus/ctf-toolsSome setup scripts for security research tools.
sleuthkit/autopsyAutopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…
secdev/scapyPython-based interactive packet manipulation library for forging, decoding, sending, capturing, and analyzing network packets across a wide range of…
intelowlproject/intelowlScalable threat intelligence platform that enriches observables and files using 200+ analyzers, with built-in GUI, REST API, and automated workflows…
asmitdesai/ubuntilsPython CLI/TUI for forensic triage of Ubuntu systems — detects and remediates persistence mechanisms with artifact collection, timeline correlation,…
