
NativeMirror
Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

Native Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.

A Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.

A python script developed to process Windows memory images based on triage type.

A Windows kernel dump C++ parser library with Python 3 bindings.

Automates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.

Windows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…

Extract Windows credentials directly from VM memory snapshots and virtual disks

Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…

Live Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Security sensor for realtime threat detection and protection

Volatility plugin for extracts configuration data of known malware

Digital forensic acquisition tool for Windows based incident response.

volatility explorer (volatility 2)

Automagically extract forensic timeline from volatile memory dump