
dwipe
Tool to securely and efficiently wipe devices and partiitions for Linux

Tool to securely and efficiently wipe devices and partiitions for Linux

File carving utility that recovers deleted files from disk images and raw drives by matching headers, footers, and internal structures via…

Commandline low level file extractor for NTFS

Library and tools to access the Volume Shadow Snapshot (VSS) format

FAT filesystems explore, extract, repair, and forensic tool

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

Find and redact secrets in AI coding agent histories (Claude Code, and more).

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

Parser for $LogFile on NTFS

ATAboy is a user-friendly bridge that allows legacy CHS only style IDE (PATA) hard drives to be connected to a modern computer as a standard USB Mass…

'Packet Capture Forensic Evidence eXtractor' is a tool that finds and extracts files from packet capture files

Python tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…

Panic button for protection against cold boot attacks

android location service cache dumper


Library to access the Windows Shell Item format

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

A bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.