
pyrebox
Python scriptable Reverse Engineering Sandbox, a Virtual Machine instrumentation and inspection framework based on QEMU

Windows artifact analysis toolkit that maps AV detections to PE offsets, sections, RVA/VA and strings, with YARA, AMSI, capa and multi-engine…

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

Digital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…

A simple, reliable and reasonably fast network capture analyzer.

Python program to steganography files into images using the Least Significant Bit.

A python script developed to process Windows memory images based on triage type.

Digital forensic acquisition tool for Windows based incident response.

ParanoiDF - PDF Analysis Suite based on PeePDF by Jose Miguel Esparza (http://peepdf.eternal-todo.com/). Tools added: Password cracking, redaction…

An forensics tool to help aid in the investigation of spoofed emails based off the email headers.

ThePhish: an automated phishing email analysis tool

Investigate malicious Windows logon by visualizing and analyzing Windows event log

A package for capturing and analyzing network flow data and intraflow data, for network research, forensics, and security monitoring.

Incident Response collection and processing scripts with automated reporting scripts

USB device connection forensics tool that traces physical device-to-computer relationships across local and domain networks, generating visual graphs…