58 tools and resources
A framework for orchestrating forensic collection, processing, and data export.
Orochi is a collaborative forensic memory dump analysis framework.
Belkasoft offers cybersecurity solutions, training, and tools for businesses, law enforcement, and academia.
Rekall is a discontinued project that aimed to improve memory analysis methodology but faced challenges due to the nature of in-memory structure and increasing security measures.
A tool that uses Plaso to parse forensic artifacts and disk images, creating custom reports for easier analysis.
A tool for parsing and extracting information from the Master File Table of NTFS file systems.
ForensicMiner, Redefine DFIR Automations
Magnet ACQUIRE offers robust data extraction capabilities for digital forensics investigations, supporting a wide range of devices.
Turbinia is an open-source framework for automating the running of common forensic processing tools to help with processing evidence in the Cloud.
PowerForensics is a PowerShell digital forensics framework for hard drive forensic analysis.
A collaborative forensic timeline analysis tool for organizing and analyzing data with rich annotations and comments.
Dissect is a digital forensics & incident response framework that simplifies the analysis of forensic artefacts from various disk and file formats.
A Python-based engine for automatic creation of timelines in digital forensic analysis
Documentation project for Digital Forensics Artifact Repository
Toolkit for post-mortem analysis of Docker runtime environments using forensic HDD copies.
Tool used for dumping memory from Android devices with root access requirement and forensic soundness considerations.
A high-performance digital forensics exploitation tool for extracting structured information from various inputs without parsing file system structures.
Automated collection tool for incident response triage in Windows systems.
Python forensic tool for extracting and analyzing information from Firefox, Iceweasel, and Seamonkey browsers.
OpenRASP directly integrates its protection engine into the application server by instrumentation, providing context-aware protection and detailed stack trace logging.
Analyse a forensic target to find and report files found and not found in hashlookup CIRCL public service.
A suite of console tools for working with timestamps in Windows with 100-nanosecond precision.
A Forensic Framework for Skype with various investigative options.
iOSForensic is a Python tool for forensic analysis on iOS devices, extracting files, logs, SQLite3 databases, and .plist files into XML.
A set of YARA rules for identifying files containing sensitive information
A free, open source collection of tools for forensic artifact and image analysis.
A user-friendly and fast Forensic Analysis tool with features like tagging files and generating preview reports.
Analyzing WiFiConfigStore.xml file for digital forensics on Android devices.
Malware sandbox for executing malicious files in an isolated environment with advanced features.
A digital forensics tool that provides read-only access to file-system objects from various storage media types and file formats.
DFIRTrack is an open source web application focused on incident response for handling major incidents with many affected systems, tracking system status, tasks, and artifacts.
LiME is a Linux Memory Extractor tool for acquiring volatile memory from Linux and Linux-based devices, including Android, with features like full memory captures and minimal process footprint.
Custom built application for asynchronous forensic data presentation on an Elasticsearch backend, with upcoming features like Docker-based installation and new UI rewrite in React.
Powerful tool for searching and hunting through Windows forensic artefacts with support for Sigma detection rules and custom Chainsaw detection rules.
Automated tool for parsing Windows registry hives and extracting valuable information for forensic analysis.
A tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container, aiding in digital forensic triage.
CyLR is a Live Response Collection tool for quickly and securely collecting forensic artifacts from hosts with NTFS file systems.
An Android-based self-defense application against forensic imaging tools like Cellebrite UFED.
A static analysis framework for extracting key characteristics from various file formats
Collects and organizes Linux OS data for detailed analysis and incident response.
Open source Python library for NTFS analysis
A cybersecurity tool for collecting and analyzing forensic artifacts on live systems.
A shell script for basic forensic collection of various artefacts from UNIX systems.
A library to access the Extensible Storage Engine (ESE) Database File (EDB) format used in various Windows applications.
A tool for extracting files from network traffic based on file signatures with support for various file formats and scalable search algorithm.
A library to access the Expert Witness Compression Format (EWF) for digital forensics and incident response.
An image with commonly used tools for creating a pentest environment easily and quickly, with detailed instructions for launching in a VPS.
MFT and USN parser for direct extraction in filesystem timeline format with YARA rule support.
A software utility with forensic tools for smartphones, offering powerful data extraction and decoding capabilities.
A cross-platform registry hive editor for forensic analysis with advanced features like hex viewer and reporting engine.
High-performance remote packet capture and collection tool used for forensic analysis in cloud workloads.
A library to access and parse Windows XML Event Log (EVTX) format, useful for digital forensics and incident response.
A library and set of tools for accessing and analyzing storage media devices and partitions for forensic analysis and investigation.
A software that collects forensic artifacts on systems for forensic investigations.
Open source digital forensics tools for analyzing disk images and recovering files.
A cybersecurity challenge where you play the role of an incident response consultant investigating an intrusion at Precision Widgets of North Dakota.
A set of scripts for collecting forensic data from Windows and Unix systems respecting the order of volatility.
