
extundelete
Undelete and recover accidentally erased files from ext3 and ext4 filesystems, using inode scanning and block recovery for forensic and data-loss…

Undelete and recover accidentally erased files from ext3 and ext4 filesystems, using inode scanning and block recovery for forensic and data-loss…

Python script for carving Bitlocker VMK keys

A forensic evidence collection & analysis toolkit for OS X

CLI tools for forensic investigation of Windows artifacts

Forensic collection and analysis toolkit for Android and iOS devices to identify potential compromise by known spyware using public and private…

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

Collection of forensic tools

Incident Response Forensic Framework

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

Cobalt Strike BOF that extracts selected Windows registry hives directly from a raw NTFS volume by parsing NTFS metadata and reading file data…

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.