
CyberPipe
An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…

Digital forensics engine that parses logs, files, and system artifacts to build super timelines, enabling chronological event correlation for…

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law…

A list of cyber-chef recipes and curated links

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from…

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Library and tools to access the Windows New Technology File System (NTFS)

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

Library and tools to access the VMware Virtual Disk (VMDK) format

Library and tools to access the Virtual Hard Disk (VHD) image format

File carving utility that recovers deleted files from disk images and raw drives by matching headers, footers, and internal structures via…

Commandline low level file extractor for NTFS

Library and tools to access the Volume Shadow Snapshot (VSS) format

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

Parser for $LogFile on NTFS