
ipsw-diffs
Publishes per-build diffs of iOS, iPadOS, and macOS IPSW firmware releases, enabling binary-level comparison of system components across versions and…

Publishes per-build diffs of iOS, iPadOS, and macOS IPSW firmware releases, enabling binary-level comparison of system components across versions and…

Manage WhatsApp .crypt12, .crypt14 and .crypt15 files.

Kernel module for volatile memory acquisition from Linux and Android devices, producing forensically sound captures to disk or over the network.

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive…

Decrypt WhatsApp encrypted media files (images, videos, audio, documents) using media keys extracted from iOS ChatStorage.sqlite or Android…

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact…

Filesystem monitor tool for Linux/Android iOS/macOS

Collection of forensic tools

androidqf (Android Quick Forensics) helps quickly gathering forensic evidence from Android devices, in order to identify potential traces of…

Collect, Process, and Hunt with host based data from MacOS, Windows, and Linux

Encrypted peer-to-peer mesh VPN for remote mobile forensics, enabling wireless ADB and libimobiledevice acquisition, network monitoring, and…

ELEGANTBOUNCER is a detection tool for file-based mobile exploits.


Extract WhatsApp private key from any non-rooted Android device (Android 7+ supported)

Portable forensic acquisition tool for Android devices that collects relevant data via USB debugging to identify potential spyware or compromise…

Bash script to extract data from a "chekcra1ned" iOS device

This toolkit aims to help forensicators perform different kinds of acquisitions on iOS devices

Tool for recovering and decrypting ES File Explorer encrypted files (.eslock)