
WhatsDump
Extract WhatsApp private key from any non-rooted Android device (Android 7+ supported)

Extract WhatsApp private key from any non-rooted Android device (Android 7+ supported)

Modular incident response toolkit for collecting forensic data from potentially infected macOS endpoints, capturing browser artifacts, persistence…

Brute-force tool that recovers full executable paths from Windows prefetch hashes using bodyfiles, supporting XP, Vista, and 2008 hash functions for…

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

Live memory analysis detecting malware IOCs in processes, modules, handles, tokens, threads, .NET assemblies, memory address space and environment…

Tool and framework for securely reading untrusted USB mass storage devices.

Swift-based macOS incident response framework for collecting and analyzing host artifacts, including filesystem timestamps, browser data, unified…

Parses Windows .evtx logs to identify remote connections and public IPs by analyzing EventIDs related to remote logins and sessions.

Automated threat hunting and incident response tool for Windows Event Logs with Sigma rule integration, real-time detection, and forensic artifact…

Extracts and exports certificate information from digitally signed PE files using Python and pefile, enabling forensic analysis of code-signing…

Bash tool used for proactive detection of malicious activity on macOS systems.

USB device connection forensics tool that traces physical device-to-computer relationships across local and domain networks, generating visual graphs…

A portable OSINT Swiss Army Knife for DFIR/OSINT professionals 🕵️ 🕵️ 🕵️

Re-play Security Events

Bash script to extract data from a "chekcra1ned" iOS device

Client-server tool for live data collection during incident response. Admin sends requests to clients to gather system information for forensic…

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

Incident Response collection and processing scripts with automated reporting scripts