
SigLens
Windows artifact analysis toolkit that maps AV detections to PE offsets, sections, RVA/VA and strings, with YARA, AMSI, capa and multi-engine…

Windows artifact analysis toolkit that maps AV detections to PE offsets, sections, RVA/VA and strings, with YARA, AMSI, capa and multi-engine…

Digital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…

A python script developed to process Windows memory images based on triage type.

A simple, reliable and reasonably fast network capture analyzer.

ParanoiDF - PDF Analysis Suite based on PeePDF by Jose Miguel Esparza (http://peepdf.eternal-todo.com/). Tools added: Password cracking, redaction…

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

Investigate malicious Windows logon by visualizing and analyzing Windows event log

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Digital forensic acquisition tool for Windows based incident response.

An forensics tool to help aid in the investigation of spoofed emails based off the email headers.

USB device connection forensics tool that traces physical device-to-computer relationships across local and domain networks, generating visual graphs…

Incident Response collection and processing scripts with automated reporting scripts

ThePhish: an automated phishing email analysis tool

Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

Python program to steganography files into images using the Least Significant Bit.