Disk-Arbitrator
aburgh/disk-arbitratorA Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
data-recoverydigital-forensicsdisk-forensics+2
717
aburgh/disk-arbitratorA Mac OS X forensic utility which manages file system mounting in support of forensic procedures.
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
azr43lkn1ght/dfir-labsHands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…
orlikoski/skadiCollect, Process, and Hunt with host based data from MacOS, Windows, and Linux
sleuthkit/sleuthkitForensic library and CLI toolkit for analyzing disk and file system images, recovering deleted data, generating timelines, and validating evidence…
google/timesketchCollaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
lazza/recuperabitA tool for forensic file system reconstruction.
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
thewhiteninja/ntfstoolForensics tool for NTFS (parser, mft, bitlocker, deleted files)
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
libyal/libewfC library and command-line toolkit for forensic EWF image handling: acquire, export, verify, recover, and mount evidence files in EnCase and SMART…
ccob/volumiserCLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…
dwmetz/cyberpipeAn easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.
jschicht/rawcopyCommandline low level file extractor for NTFS