Tools

theevidencehunter/forensix

Digital Forensics Intelligence Framework

frankwxu/digital-forensics-lab

Hands-on digital forensics lab curriculum with case studies in disk, memory, network, and mobile forensics, plus AI-powered investigation modules and…

google/grr

Remote live forensics and incident response framework with Python agent for collecting forensic data from endpoints, including memory, disk, and…

sepinf-inc/iped

Open-source digital forensic platform for processing and analyzing seized evidence. Supports disk images, file carving, hash analysis, OCR, audio…

sleuthkit/autopsy

Open-source digital forensics platform for disk image analysis, file recovery, timeline creation, and detailed artifact extraction.

neo23x0/loki

IOC and YARA-based scanner for detecting indicators of compromise via file name regex, YARA signatures, hash matching, and C2 back-connect checks on…

mattnotmax/cyberchef-recipes

Curated collection of recipes for DFIR, malware deobfuscation, and data transformation, with regex patterns, decoding workflows, and incident…

ericzimmerman/kapefiles

This repository serves as a place for community created Targets and Modules for use with KAPE.

pablolec/recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

fox-it/dissect

Unified digital forensics & incident response framework for parsing disk images, file systems, and OS artifacts across Windows, Linux, and ESXi…

bert-janp/incident-response-powershell

PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

diogo-fernan/ir-rescue

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

r3nzsec/irflow-timeline

DFIR Timeline Analysis for macOS — SQLite-backed viewer for CSV, TSV, XLSX, EVTX, Plaso, $MFT, and $J files with AI Artifacts, AI Secret Hunt,…

rowingdude/analyzemft

Python tool to parse and analyze NTFS Master File Table (MFT) data, extracting file metadata, timestamps, and attributes for digital forensics and…

dwmetz/cyberpipe

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

orlikoski/skadi

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

kfallahi/underlaycopy

PowerShell toolkit that extracts locked Windows files (SAM, SYSTEM, NTDS, ...) using MFT parsing and raw disk reads

gregwar/fatcat

FAT filesystems explore, extract, repair, and forensic tool