factual-rules-generator
circl/factual-rules-generatorGenerates YARA rules from installed software on a running OS to baseline known software and find similar installations across digital forensic…
digital-forensicsforensicsinformation-gathering+1
circl/factual-rules-generatorGenerates YARA rules from installed software on a running OS to baseline known software and find similar installations across digital forensic…
wireshark/wiresharkCapture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
circl/ail-frameworkAIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project
ssrajadh/sentrysearchSemantic search over videos using Gemini Embedding 2 or Qwen3-VL.
d4vinci/exif-grabberA python tool that will extract exif data from picture with two methods
tclahr/uacPortable, dependency-free incident response tool that automates forensic artifact collection from Unix-like systems, including memory acquisition,…
gr33nm0nk2802/mailmetaAn forensics tool to help aid in the investigation of spoofed emails based off the email headers.
attackercan/teamviewer-dumperDump TeamViewer ID and password from memory. Works much better than other tools.
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
darkquasar/azurehunterA Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365
redaelli/imago-forensicsImago is a python tool that extract digital evidences from images.
synacktiv/sharkerA simple, reliable and reasonably fast network capture analyzer.
joshatticus/ztewasteExtract a concerning amount of user information from Unisoc ZTE devices using CVE-2022-38694.
nightbringer21/fridumpCross-platform memory dumper using Frida to extract accessible memory from iOS, Android, and Windows applications for forensic analysis and…
nccgroup/metadataplusA tool to use novel locations to extract metadata from Office documents.
destiny-creates/goxlr-malware-familyMalware analysis from the domain goxlr.net
mlcsec/proctoolsSmall toolkit for extracting information and dumping sensitive strings from Windows processes