
RdpCacheStitcher
RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.


An forensics tool to help aid in the investigation of spoofed emails based off the email headers.

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack

Native YARA scanner X-Tension for X-Ways Forensics, enabling in-snapshot file scanning with multi-threaded RVS support, report table output, and no…

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

PacketSifter is a tool/script that is designed to aid analysts in sifting through a packet capture (pcap) to find noteworthy traffic. Packetsifter…

Hunts out CobaltStrike beacons and logs operator command output

A Cloud Forensics Powershell module to run threat hunting playbooks on data from Azure and O365

Lua plugin to extract data from Wireshark and convert it into MISP format

System-based incident response tracking application for managing large-scale DFIR cases, with import/export, task workflows, and artifact tracking…

Rust-based Windows forensic toolkit for real-time MFT monitoring, event log streaming, and channel enumeration, enabling live system analysis and…

GUI forensic tool for acquiring and analyzing Telegram data from Android devices. Parses messages, media, and metadata; generates integrity-verified…

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

Portable forensic acquisition tool for Android devices that collects relevant data via USB debugging to identify potential spyware or compromise…

Decrypt WhatsApp encrypted media files (images, videos, audio, documents) using media keys extracted from iOS ChatStorage.sqlite or Android…

A tool to parse Firefox and Chrome HSTS databases into forensic artifacts!

Event Trace Log file parser in pure Python