Tools

wiltodelta/remove-ai-watermarks

Remove visible and invisible AI watermarks from images and video, and AI provenance metadata from images, video, and audio. Python library, CLI, and…

thomasareed/pict

Modular incident response toolkit for collecting forensic data from potentially infected macOS endpoints, capturing browser artifacts, persistence…

ddz/whatsapp-media-decrypt

Decrypt WhatsApp encrypted media files (images, videos, audio, documents) using media keys extracted from iOS ChatStorage.sqlite or Android…

cisco/joy

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

nour833/stegoforge

The ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run…

moond4rk/hackbrowserdata

Decrypt and export passwords, cookies, history and more from 20 browsers on Windows, macOS and Linux. For authorized security research, incident…

maldev-academy/dumpbrowsersecrets

Extracts browser-stored data such as refresh tokens, cookies, saved credentials, credit cards, autofill entries, browsing history, and bookmarks from…

ccob/volumiser

CLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…

redaelli/imago-forensics

Imago is a python tool that extract digital evidences from images.

ivancabrera02/srhollow

Extracts LSA secrets and DPAPI keys from Windows registry hives via existing or newly created VSS shadow copies, with an inline regf parser and…

3gstudent/ntfsdump

Use to copy a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.

davidjacobson/safetext

Script to remove homoglyphs and zero-width characters to allow for safe distribution of documents from anonymous sources.

d4vinci/chrome-extractor

Python script that will extract all saved passwords from your google chrome database on windows only

harelsegev/prefetch-hash-cracker

Brute-force tool that recovers full executable paths from Windows prefetch hashes using bodyfiles, supporting XP, Vista, and 2008 hash functions for…

telegrip/telegrip

GUI forensic tool for acquiring and analyzing Telegram data from Android devices. Parses messages, media, and metadata; generates integrity-verified…

pugazhendii22/keepass-exfil-forensics

Network forensics writeup + tooling for a TryHackMe DFIR challenge: reverses a hex→Base64→XOR exfiltration chain from PCAP traffic, then recovers a…

maldev-academy/dumpchromesecrets

Extract data from modern Chrome versions, including refresh tokens, cookies, saved credentials, autofill data, browsing history, and bookmarks

guillaumemeyer/watermarks-remover

A privacy-first app that strips AI watermarks from content you own.