
dfir-orc
Forensics artefact collection tool for systems running Microsoft Windows
defensive-toolsdigital-forensicsforensics+2

Forensics artefact collection tool for systems running Microsoft Windows

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Tool to find metadata and hidden information in the documents.

Windows tool for dumping malware PE files from memory back to disk for analysis.