Tools

jschicht/extractusnjrnl

Tool to extract the $UsnJrnl from an NTFS volume

trustedsec/tscopy

Python tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…

dcarrero/mboxshell

mboxShell. Fast terminal viewer for MBOX files of any size. Open, search and export emails from Gmail Takeout backups (50GB+) without loading them…

d4vinci/exif-grabber

A python tool that will extract exif data from picture with two methods

telegrip/telegrip

GUI forensic tool for acquiring and analyzing Telegram data from Android devices. Parses messages, media, and metadata; generates integrity-verified…

fran314/secrets-manager-rs

A command-line tool for securely backing up, restoring, and verifying secrets using interoperable standards like age encryption and coreutils,…

desireeontrial76/yellowkey-bitlocker

Manage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.

iqbaalilmii/acropalypse-reconstructor

A lightweight CLI tool to detect and reconstruct cropped images vulnerable to Acropalypse (CVE-2023-21036 and CVE-2023-28303) written in Python.

notaswe/gocropalypse

Go-based detection tool for CVE-2023-21036 (Acropalypse) vulnerability in PNG/GIF images, scanning directories to identify cropped images with…

seyyidkadir/filedumper

Windows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…

sleuthkit/scalpel

File carving and indexing tool for digital forensics, recovering files from disk images based on header/footer pattern matching, regular expressions,…

cado-security/rip_raw

Rip Raw is a small tool to analyse the memory of compromised Linux systems.

elevenpaths/iphonerestrictionspasscodebf

Extracts and decrypts the 4-digit restriction passcode from iPhone backups on Windows machines, enabling recovery of device access controls.

battalkoc/kalici-dosya-silme-araci

Securely deletes files by overwriting them with user-specified iterations of random data, then removes the file to prevent recovery. Supports Python…

velocidex/velociraptor

Digging Deeper....

simsong/bulk_extractor

This is the development tree. Production downloads are at:

piat0n/baremetal-ram-dumper

A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.

ishannaik/agent-sweep

Find and redact secrets in AI coding agent histories (Claude Code, and more).