
whatfiles
Log what files are accessed by any Linux process
digital-forensicsforensicsgeneral-purpose-utilities

Log what files are accessed by any Linux process

Read-only Windows forensic scanner for software traces — persistence, execution artifacts (Prefetch, Shimcache, BAM), user activity and Ghost Tasks…

Analyze, extract and visualize features, artifacts and IoCs of files and memory dumps (Windows, Linux, Android, iPhone, Blackberry, macOS binaries,…

PowerShell script helping Incident Responders discover potential adversary persistence mechanisms.