ArtifactExtractor
ArtifactExtractor is a script that extracts common Windows artifacts from source images and VSCs. Artifacts in VSCs will be checked (via hash) if they are different from a later VSC/image copy before extraction. Dependencies: - None if using release executable on Windows. - Else: Install backports.lzma - Windows: Use latest wheel file available from [here] - Linux: Use a package manager, e.g. sudo apt install liblzma-dev - Install libewf libewf-legacy should be installed rather than libewf (experimental) - Newer experimental releases have a file corruption issue. - Windows: Use the MSI installer available from [here] - Linux: Use libewf-legacy build 20140806 (Windows ONLY) - Install pywin32: pip install pywin32 - Install remaining requirements: use requirements.txt - Use pip: pip install -r requirements.txt Usage: Create destination directory artifact_extractor.exe <source image> <dest dir> [-a <selected artifacts>] or artifact_extractor.exe -h for more options Credits: Joachim Metz and his libraries, John Corcoran for Unix Compatibility
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A user-friendly and fast Forensic Analysis tool with features like tagging files and generating preview reports.
Comprehensive suite for advanced file analysis and software supply chain security.
A command-line utility and Python package for mounting and unmounting various disk image formats with support for different volume systems and filesystems.
A PowerShell-based incident response and live forensic data acquisition tool for Windows hosts.
Fridump is an open source memory dumping tool using the Frida framework for dumping memory addresses from various platforms.
A Windows Registry hive extraction library that reads and writes Windows Registry 'hive' binary files.
Review of various MFT parsers used in digital forensics for analyzing NTFS file systems.
A command-line utility for extracting human-readable text from binary files.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.