Tools

dfir-orc/dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows

6abd/horus

An OSINT / digital forensics tool built in Python

theevidencehunter/forensix

Digital Forensics Intelligence Framework

nccgroup/impossibletravelloganalysis

Basic log analysis tool to detect impossible travel via IP address geographic information

nccgroup/metadataplus

A tool to use novel locations to extract metadata from Office documents.

cristianzsh/amcache-evilhunter

Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.

piotr-kniaz/eslockdecryptor

Utility for recovering ES File Explorer encrypted files (.eslock)

efforg/rayhunter

Rust tool to detect cell site simulators on an orbic mobile hotspot

hellman/xortool

A tool to analyze multi-byte xor cipher

hiddenillusion/nomorexor

Tool to help guess a files 256 byte XOR key by using frequency analysis

simsong/bulk_extractor

This is the development tree. Production downloads are at:

d4vinci/exif-grabber

A python tool that will extract exif data from picture with two methods

7h3ram/flowinspect

A Network Inspection Tool

virustotal/yara

The pattern matching swiss knife

boobalover7/yellowkey-bitlocker-cve-2026-45585

Manage BitLocker recovery keys, monitor drive encryption status, and unlock volumes through a portable interface for Windows.

osirislab/awesome-rust-security

Curated list of awesome projects and resources related to Rust and computer security

rowingdude/analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

politoinc/xwfacropalypse

X-Ways Acropalypse extension detects CVE-2023-21036 in common images