#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
k1nd0ne/volwebA centralized and enhanced memory analysis platform
ioactive/platboxPlatform security assessment tool for dumping and analyzing UEFI/SMM registers, PCI config space, physical memory, SPI flash, and S3 bootscripts with…
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
alex-cart/leafLinux Evidence Acquisition Framework
bohops/rogueassemblyhunterRogue Assembly Hunter is a utility for discovering 'interesting' .NET CLR modules in running processes.
hasherezade/hollows_hunterScans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory…
halpomeranz/lmgScript for automating Linux memory capture and analysis
kevoreilly/capev2Malware Configuration And Payload Extraction
arinerron/heaptracehelps visualize heap operations for pwn and debugging
andreafortuna/autotimelinerAutomagically extract forensic timeline from volatile memory dump
frankwxu/digital-forensics-labFree hands-on digital forensics labs for students and faculty
mgeeky/threadstackspooferThread Stack Spoofing - PoC for an advanced In-Memory evasion technique allowing to better hide injected shellcode's memory allocation from scanners…
ajmartel/irtriageIncident Response Triage - Windows Evidence Collection for Forensic Analysis
velocidex/winpmemThe multi-platform memory acquisition tool.
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
visma-prodsec/columboML-assisted forensic analysis tool that automates memory, disk, and live system triage on Windows using Volatility 3, autorunsc, and sigcheck to…
fboldewin/atmmalscanCommand-line DFIR tool for scanning Windows ATM systems to detect malware traces in process memory and disk, with automated memory dump creation for…
