Tools

velocidex/velociraptor

Digging Deeper....

marin-m/vmlinux-to-elf

A tool to recover a fully analyzable .ELF from a raw kernel, through extracting the kernel symbol table (kallsyms)

google/timesketch

Collaborative forensic timeline analysis platform for ingesting, searching, and annotating event logs to support incident response and DFIR…

sepinf-inc/iped

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by…

rsactftool/rsactftool

RSA attack tool (mainly for ctf) - retrieve private key from weak public key and/or uncipher data

desireeontrial76/yellowkey-bitlocker

Manage and recover BitLocker encrypted drives with this tool for Windows 11 recovery key management and educational study of CVE-2026-45585.

simsong/bulk_extractor

This is the development tree. Production downloads are at:

synacktiv/kcmdump

Dump Kerberos tickets from the KCM database of SSSD

xchwarze/magic-extractor

Universal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.

emn4tor/seal

Peer-to-peer, end-to-end encrypted chat. No inbox. No account to recover. Nobody's listening — not even us.

lazza/recuperabit

A tool for forensic file system reconstruction.

pablolec/recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

thewhiteninja/ntfstool

Forensics tool for NTFS (parser, mft, bitlocker, deleted files)

dmtrkovalenko/ffs

F*ck file system - cli file search tool that bypasses OS kernel and reads your disc directlry

theevidencehunter/forensix

Digital Forensics Intelligence Framework

spipm/depixelization_poc

Depix is a PoC for a technique to recover plaintext from pixelized screenshots.

adamwhitehat/judge-jury-and-executable

A file system forensics analysis scanner and threat hunting tool. Scans file systems at the MFT and OS level and stores data in SQL, SQLite or CSV.…