VMkatz
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
digital-forensicsexploitationforensics+7
nikaiw/vmkatzExtract Windows credentials directly from VM memory snapshots and virtual disks
rabbitstack/fibratusSecurity sensor for realtime threat detection and protection
habanada/nativemirrorNative Delphi implementation of PE-sieve functionality with a reusable library, CLI, and PE-sieve-compatible DLL for HollowsHunter integration.
volatilityfoundation/volatility3Advanced framework for extracting digital artifacts from volatile memory (RAM) samples, enabling deep forensic analysis of system runtime state…
lethal-forensics/memprocfs-analyzerAutomates Windows memory forensics and DFIR workflows with MemProcFS: YARA/ClamAV scanning, process anomaly detection, and artifact/log extraction.
andreafortuna/autotimelinerAutomagically extract forensic timeline from volatile memory dump
seyyidkadir/filedumperWindows memory forensics tool for dumping files from process memory regions, searching byte patterns (PDF, JPG, SWF), and performing live process…
0vercl0k/kdmp-parserA Windows kernel dump C++ parser library with Python 3 bindings.
travisfoley/dfirtriageDigital forensic acquisition tool for Windows based incident response.
jpcertcc/malconfscanVolatility plugin for extracts configuration data of known malware
blueteam0ps/memoptixA Jupyter notebook to assist with the analysis of the output generated from Volatility memory extraction framework.
crowdstrike/supermemA python script developed to process Windows memory images based on triage type.
diogo-fernan/ir-rescueA Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
sekoialab/fastir_collectorLive Windows forensic acquisition tool that collects system artefacts (registry, memory, disk, files) into CSV/JSON for early compromise detection…
memoryforensics1/volexpvolatility explorer (volatility 2)
