MESH
barghest-ngo/meshEncrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…
android-securitydigital-forensicsencryption-decryption-tools+8
barghest-ngo/meshEncrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…
simsong/bulk_extractorThis is the development tree. Production downloads are at:
invictus-ir/alfaAutomated forensic analysis tool for Google Workspace audit logs. Acquires all log types, maps events to MITRE ATT&CK Cloud Framework, and identifies…
sepinf-inc/ipedIPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…
talha-nazeef-ahmed/alpc-enumeratorA Windows userland tool to enumerate and classify ALPC ports, including PPL-protected processes.
mvt-project/androidqfandroidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of…
xchwarze/magic-extractorUniversal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.
6abd/horusAn OSINT / digital forensics tool built in Python
dfir-orc/dfir-orcForensics artefact collection tool for systems running Microsoft Windows
lazza/recuperabitA tool for forensic file system reconstruction.
pablolec/recoverpyInteractively find and recover deleted or :point_right: overwritten :point_left: files from your terminal
go-lanz/persistnuxBash-based Linux persistence detection tool for DFIR investigations. Scans 15+ persistence mechanisms (systemd, cron, kernel modules, SSH,…
piat0n/baremetal-ram-dumperA bare-metal x86 utility to dump physical RAM directly to disk. Built and tested for Cold Boot Attack experiments on frozen memory.
0xsp-srd/aetherWindows memory-forensics and threat hunting tool that scans live process memory for malicious patterns, injection techniques, and reflectively loaded…
invictus-ir/microsoft-extractor-suiteA PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
thewhiteninja/ntfstoolForensics tool for NTFS (parser, mft, bitlocker, deleted files)
dmtrkovalenko/ffsF*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry
iqbaalilmii/acropalypse-reconstructorA lightweight CLI tool to detect and reconstruct cropped images vulnerable to Acropalypse (CVE-2023-21036 and CVE-2023-28303) written in Python.