24 tools and resources
An LLM-based honeypot file system creator that generates realistic file systems and configurations to lure attackers and improve analyst engagement.
A tool for parsing and extracting information from the Master File Table of NTFS file systems.
A free, open-source file data recovery software that can recover lost files from hard disks, CD-ROMs, and digital camera memory.
A utility for recovering deleted files from ext3 or ext4 partitions.
A library and tools to access and analyze APFS file systems
A high-performance digital forensics exploitation tool for extracting structured information from various inputs without parsing file system structures.
Utilizing Alternate Data Streams (ADS) to bypass AppLocker default policies by loading DLL/CPL binaries.
An open source digital forensic tool for processing and analyzing digital evidence with high performance and multiplatform support.
Review of various MFT parsers used in digital forensics for analyzing NTFS file systems.
A demonstration of a method to delete a locked executable or currently running file from disk.
TestDisk is a free data recovery software that can recover lost partitions and undelete files from various file systems.
A digital forensics tool that provides read-only access to file-system objects from various storage media types and file formats.
A steganographic file system in userspace for plausible deniability of files.
CyLR is a Live Response Collection tool for quickly and securely collecting forensic artifacts from hosts with NTFS file systems.
Open source Python library for NTFS analysis
A library to access FileVault Drive Encryption (FVDE) encrypted volumes on Mac OS X systems.
A Mac OS X forensic utility for ensuring correct forensic procedures during disk imaging.
TestDisk checks disk partitions and recovers lost partitions, while PhotoRec specializes in recovering lost pictures from digital camera memory or hard disks.
MFT and USN parser for direct extraction in filesystem timeline format with YARA rule support.
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
GVfs is a userspace virtual filesystem implementation for GIO with various backends and features.
APFS is a proprietary file system developed by Apple for macOS, offering improved performance, security, and reliability.
A free, fast, and flexible multi-platform IOC and YARA scanner for Windows, Linux, and macOS.
View physical memory as files in a virtual file system for easy memory analysis and artifact access.
