
Incident-Response-Powershell
PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
digital-forensicsdisk-forensicsforensics+6

PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

Python script for carving Bitlocker VMK keys

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

A forensic evidence collection & analysis toolkit for OS X