velociraptor
velocidex/velociraptorEndpoint visibility and collection tool using VQL queries for host-based state information gathering, incident response triage, and forensic artifact…
data-recoverydefensive-toolsdigital-forensics+8
4.2k
velocidex/velociraptorEndpoint visibility and collection tool using VQL queries for host-based state information gathering, incident response triage, and forensic artifact…
google/grrRemote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…
sepinf-inc/ipedOpen-source digital forensic platform for processing and analyzing seized evidence. Supports disk images, file carving, hash analysis, OCR, audio…
neo23x0/lokiIOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…
mattnotmax/cyberchef-recipesCurated collection of recipes for DFIR, malware deobfuscation, and data transformation, with regex patterns, decoding workflows, and incident…
ericzimmerman/kapefilesThis repository serves as a place for community created Targets and Modules for use with KAPE.
virustotal/yara-xRust-based pattern matching engine for malware researchers. Create YARA rules with textual/binary patterns, wildcards, and regex to identify and…
lazza/recuperabitA tool for forensic file system reconstruction.
cristianzsh/forensictoolsWindows toolkit that installs and configures a comprehensive suite of digital forensics and incident response tools, integrating them into the system…
fox-it/dissectUnified digital forensics & incident response framework for parsing disk images, file systems, and OS artifacts across Windows, Linux, and ESXi…
bert-janp/incident-response-powershellPowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…
thewhiteninja/ntfstoolForensics tool for NTFS (parser, mft, bitlocker, deleted files)
teamdfir/siftSANS DFIR forensic workstation distribution with pre-configured tools for memory analysis, disk forensics, timeline analysis, and incident response,…
r3nzsec/irflow-timelineDFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…
eua/wxhexeditorCross-platform hex editor for large files and disks, supporting binary data inspection, disk editing, and memory analysis for forensic and reverse…
rowingdude/analyzemftPython tool to parse and analyze NTFS Master File Table (MFT) data, extracting file metadata, timestamps, and attributes for digital forensics and…
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
ccob/volumiserCLI and interactive console for listing, browsing, and extracting files from VM disk images (VHDX, VMDK, EBS snapshots, raw disks) for red-team…