
evtx
A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

pefile is a Python module to read and work with PE (Portable Executable) files

Per-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.

Free hands-on digital forensics labs for students and faculty

IoCs and YARA rules from Threatray's Threat Research

AIL framework - Analysis Information Leak framework. Project moved to https://github.com/ail-project

Fast and accurate AI powered file content types detection

Awesome-Cellular-Hacking

Extract files from any kind of container formats

Bulk-run Hayabusa across a folder of triage collections, one run per host, with per-host reports and a cross-host triage dashboard

The system of action for AI-native cybersecurity—where intent becomes governed execution, evidence becomes operational memory, and every operation…

UNIX-like reverse engineering framework and command-line toolset

Parses iOS and iPadOS forensic extractions into HTML, TSV, timeline, KML, and LAVA reports with modular artifact discovery and encrypted iTunes…

Capture and analyze network traffic with deep packet inspection, protocol decoding across hundreds of protocols, and capture-file support for…

Open-source Windows forensics engine that acquires, parses, and correlates artifacts (MFT, USN, Registry, etc.) to reconstruct timelines with…

Real-time Windows system monitor with advanced process, network, and disk analysis, stack trace debugging, malware detection, and service management.…

Automated YARA rule generation from the Cert Central compromised certificate database.

OS-level runtime auditing for unpredictable automation.