
ffs
F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry


Tool to extract the $UsnJrnl from an NTFS volume

A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.

Library and tools to access the QEMU Copy-On-Write (QCOW) image format

Builds forensic file hash sets from disk images, packages, and archives across GCP, AWS, and local sources, with deduplication and PostgreSQL/Spanner…

Undelete and recover accidentally erased files from ext3 and ext4 filesystems, using inode scanning and block recovery for forensic and data-loss…

Acquires the EBS disks of an AWS AMI you can launch, streaming snapshots via EBS direct APIs to a private S3 bucket with sha256 manifests and…

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.


It's not just UsnJrnl (USN Journal Records/Change Journal Records) parser.

ltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…

Python script for carving Bitlocker VMK keys

Proof-of-concept Velociraptor artifacts pack to showcase a remote Veeam forensics pipeline.

Digital Forensics Intelligence Framework

Copies data from damaged or failing storage devices, handles read errors, and performs efficient rescue operations to recover as much data as…
