
miniDumpReader
Parses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…

Parses Windows MiniDump (MDMP) files with Kaitai Struct, extracting memory strings and scanning them against YARA rules for forensic and malware…

Offset Independent Credential Extraction Tool

DFIR forensics companion server + capture extension

Simple Process Dumper using DMA over a PCIe FPGA device

Hands-on DFIR challenges covering digital forensics, incident response, malware analysis, and threat hunting with CTF-style flags and real-world…

Volatility 3 ported to Rust. Same output, much faster.

Retrieves the master password from Keepass memory dump, using a hint of bruteforce.

Volatility plugins for memory forensics, including detection of Gargoyle memory scanning evasion techniques.

Scripts for extracting useful information from infected memory dumps

Kernel module for volatile memory acquisition from Linux and Android devices, producing forensically sound captures to disk or over the network.

Curated index of incident response and DFIR tools, including memory and disk forensics, evidence collection, log analysis, playbooks, and educational…

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

Portable Linux RAM acquisition tool for forensics and incident response, capturing LiME-compatible images with optional compression and remote…

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.

A python script developed to process Windows memory images based on triage type.

A Windows kernel dump C++ parser library with Python 3 bindings.

Visualize the virtual address space of a Windows process on a Hilbert curve.