log2timeline/plasoDigital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…
mvt-project/mvtForensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…
cgsecurity/testdiskRecovers lost partitions and repairs boot sectors; carves 480+ file formats from damaged disks and filesystems for data recovery and forensic use.
fox-it/dissectDissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…
meirwah/awesome-incident-responseCurated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…
radkawar/aws-firmware-dumpAcquires the EBS disks of an AWS AMI you can launch, streaming snapshots via EBS direct APIs to a private S3 bucket with sha256 manifests and…
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
cristianzsh/forensictoolsCollection of forensic tools
adamwhitehat/judge-jury-and-executableA file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…
fishermavis/bsod_bitlocker_recoverPython script for carving Bitlocker VMK keys
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
aburgh/disk-arbitratorA Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
dfir-dd/dfir-toolkitCLI tools for forensic investigation of Windows artifacts
securityjoes/forensicminerA really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.
synacktiv/veeam-velociraptorProof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.