
Incident-Response-Powershell
PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

PowerShell-based incident response toolkit that collects 25+ forensic artifacts (processes, network connections, registry, browser history) and…

Automated Linux incident response script with live triage, memory acquisition (LiME), disk imaging, YARA scanning, and HTML report generation.

Python script for carving Bitlocker VMK keys

This repo contains my python script version of CVE-2025-14847 (MongoBleed)

CVE-2025-14847 (MongoBleed)

ComfyEngine is a memory exploration toolkit built for people who need to monitor, patch, and script a running process.

An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.

Automated PowerShell script for forensically sound Windows memory acquisition, including crash/raw dumps, pagefile collection, triage artifacts, and…

Executes arbitrary ELF binaries directly from memory on Linux without touching disk, enabling stealthy red-teaming and anti-forensic operations via a…


A python script developed to process Windows memory images based on triage type.

Retrieve the master password of a keepass database <= 2.53.1

Heap analysis tooling for dlmalloc

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

Script for automating Linux memory capture and analysis

A forensic evidence collection & analysis toolkit for OS X

libtalloc is a python script for use with GDB that can be used to analyse the "trivial allocator" (talloc)

Grab ssh keys from ssh-agent