IPED
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
data-recoverydigital-forensicsdisk-forensics+9
3.0k
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
desireeontrial76/yellowkey-bitlockerManage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.
libyal/libfsntfsLibrary and tools to access the Windows New Technology File System (NTFS)
libyal/libfwsiLibrary to access the Windows Shell Item format
m31r0n/sniprecover-cliDetection and restoration of Windows Snipping Tool PNG captures vulnerable to CVE-2023-28303
battalkoc/kalici-dosya-silme-araciSecurely deletes files by overwriting them with user-specified iterations of random data, then removes the file to prevent recovery. Supports Python…
xchwarze/magic-extractorUniversal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.
neccie/yellowkey-bitlocker-cve-2026-45585Manage BitLocker recovery keys, unlock encrypted drives, and monitor encryption status with this lightweight Windows utility.
pelock/total-commander-ftp-password-recovery-tool-pythonTotal Commander FTP Password Recovery Tool for Python allows you to decrypt the FTP account password information for all Total Commander versions…
seyyidkadir/filedumperWindows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…
sleuthkit/autopsyAutopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…
den4uk/andriller📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive…
mvt-project/androidqfandroidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of…
libyal/libvshadowLibrary and tools to access the Volume Shadow Snapshot (VSS) format
kfallahi/underlaycopyPowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads
redrum0381/ataboyATAboy is a user-friendly bridge that allows legacy CHS only style IDE (PATA) hard drives to be connected to a modern computer as a standard USB Mass…
trustedsec/tscopyPython tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…
piat0n/baremetal-ram-dumperA bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.