Forensics

dfir-orc/dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows

kacos2000/evtx_log_browser

Evtx Log (xml) Browser

anssi-fr/dfir4vsphere

Powershell module for VMWare vSphere forensics

pbnj/infosec-interview-questions

🗒️ A [work-in-progress] collection for interview questions for Information Security roles

binref/refinery

Composable command-line toolkit for malware triage and binary analysis: decode, decrypt, carve, and extract indicators from malicious files and…

withsecurelabs/chainsaw

Rapidly Search and Hunt through Windows Forensic Artefacts

infobyte/wiremax

Lua-based Wireshark postdissector that decrypts and parses Ubiquiti AirMAX/RouterBoard 802.11 vendor IEs into filterable fields.

mandiant/macos-unifiedlogs

Parses Apple Unified Logs to extract process, thread, activity, timestamp, and message metadata from logarchives or live macOS systems into JSONL/CSV…

blueteam0ps/memoptix

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.

crowdstrike/supermem

A python script developed to process Windows memory images based on triage type.

ashemery/linuxforensics

Everything related to Linux Forensics

andrewrathbun/dfirartifactmuseum

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact…

0vercl0k/kdmp-parser

A Windows kernel dump C++ parser library with Python 3 bindings.

cecio/usbvalve

Expose USB activity on the fly

0vercl0k/clairvoyance

Visualize the virtual address space of a Windows process on a Hilbert curve.