usbsas
cea-sec/usbsasTool and framework for securely reading untrusted USB mass storage devices.
data-recoverydefensive-toolsdigital-forensics+1
cea-sec/usbsasTool and framework for securely reading untrusted USB mass storage devices.
mthcht/awesome-listsCurated repository of threat intelligence feeds, IoC lists, YARA rules, and DFIR tool references for SOC/CERT/CTI detection and incident response.
yamato-security/hayabusaMulti-threaded Windows event log forensics timeline generator and threat hunting tool with full Sigma rule support, producing CSV/JSON timelines for…
functori/argos/argosAnalysis and Representation of Graphs of Suspicious Operations (Analyse et Représentation des Graphes des Opérations Suspectes)
proxymanapp/tcpviewerThe best-in-class macOS app to See every packet clearly on your Mac. Alternative to Wireshark
winsiderss/systeminformerReal-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…
abrignoni/aleappAndroid Logs Events And Protobuf Parser
abrignoni/ileappParses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…
zeek/zeekZeek is a powerful network analysis framework that is much different from the typical IDS you may know.
simsong/tcpflowTCP/IP packet demultiplexer. Download from:
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
dcarrero/mboxshellmboxShell. Fast terminal viewer for MBOX files of any size. Open, search and export emails from Gmail Takeout backups (50GB+) without loading them…
matthart1983/netwatchReal-time network diagnostics in your terminal. One command, zero config, instant visibility.
barghest-ngo/meshEncrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…
cisagov/malcolmContainerized network traffic analysis suite ingesting PCAP, Zeek logs, and Suricata alerts for automated normalization, enrichment, and correlation…
idaholab/malcolmMalcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata…
pnwcomputers/ultimate-cybersecurity-master-guideThis repository provides a centralized resource for operational cyber defense and offense, compiling Theory, Tools, Operating Procedures, and…