realitynet/android-forensics-referencesCurated reference for Android forensic artifacts and log paths, with links to CTF writeups, research papers, and mobile device analysis tooling.
halpomeranz/lmgScript for automating Linux memory capture and analysis
remnux/distroProvides supplemental files and Debian package sources for a specialized Linux distro focused on malware analysis, reverse engineering, and digital…
santoku/santoku-linuxLinux Distro for Mobile Security, Malware Analysis, and Forensics
pinksawtooth/how_to_become_a_malware_analystCurated guide to becoming a malware analyst, covering essential knowledge, reverse engineering, analysis tools, and LLM-assisted learning with…
fireeye/pywintracePython ctypes wrapper for Event Tracing for Windows (ETW) enabling session control, event capture, and custom callbacks for security monitoring and…
trailofbits/mquireZero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
zx41r/awesome-reverse-engineering-and-malware-analysisA verified map of reverse engineering and malware analysis. Disassemblers, unpacking, exploit dev, fuzzing, DFIR, and the deep-cut writeups other…
clausing/scriptsCollection of Python and Perl scripts for digital forensics, incident response, and network analysis, including hash signature tooling and packet…
ghassan-elsman/crow-eyeOpen-source Windows forensics engine that acquires, parses, and correlates artifacts (MFT, USN, Registry, etc.) to reconstruct timelines with…
ajmartel/irtriageIncident Response Triage - Windows Evidence Collection for Forensic Analysis
trolldbois/python-haystackProcess heap analysis framework - Windows/Linux - record type inference and forensics
idiom/pftriagePython tool and library to help analyze files during malware triage and analysis.
kd8bny/limeaideA python application designed to remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.
evyatarmeged/stegextractBash script that extracts trailing data, embedded files, and hidden strings from PNG, JPG, and GIF images using magic numbers and hexdump analysis.
patrickdw123/paranoidfParanoiDF - PDF Analysis Suite based on PeePDF by Jose Miguel Esparza (http://peepdf.eternal-todo.com/). Tools added: Password cracking, redaction…
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
rjbhide/wireshark-forensics-pluginWireshark plugin that correlates network traffic with threat intelligence, asset tags, and vulnerability data to accelerate forensic analysis of PCAP…
