Tools

velocidex/velociraptor

Digging Deeper....

google/timesketch

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

simsong/bulk_extractor

This is the development tree. Production downloads are at:

virustotal/yara-x

A rewrite of YARA in Rust.

xchwarze/magic-extractor

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

sepinf-inc/iped

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

lazza/recuperabit

A tool for forensic file system reconstruction.

pablolec/recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

thewhiteninja/ntfstool

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

dmtrkovalenko/ffs

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

theevidencehunter/forensix

Digital Forensics Intelligence Framework

adamwhitehat/judge-jury-and-executable

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…

fishermavis/bsod_bitlocker_recover

Python script for carving Bitlocker VMK keys

rowingdude/analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

gregwar/fatcat

FAT filesystems explore, extract, repair, and forensic tool

ccob/volumiser

CLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…

securityjoes/forensicminer

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

alex-cart/leaf

Linux Evidence Acquisition Framework