
GhostTrace
Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…
digital-forensicsforensicsincident-response+3

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…
Sorry ransomware (.sorry) IOCs, YARA rules and forensic analysis - CVE-2026-41940 cPanel campaign

Extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers

Lack of argument sanitization leading to password leakage in Ghostscript PDF versions up to 10.05.0.

Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.

A Repository to Track Anti-Forensic Techniques

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices