ArtifactExtractor
0 (0)
A script for extracting common Windows artifacts from source images and VSCs with detailed dependencies and usage instructions.
A portable volatile memory acquisition tool for Linux. AVML is an X86_64 userland volatile memory acquisition tool written in Rust, intended to be deployed as a static binary. AVML can be used to acquire memory without knowing the target OS distribution or kernel a priori. No on-target compilation or fingerprinting is needed. Features: - Save recorded images to external locations via Azure Blob Store or HTTP PUT - Automatic Retry (in case of network connection issues) with exponential backoff for uploading to Azure Blob Store - Optional page level compression using Snappy - Uses LiME output format (when not using compression) Memory Sources: - /dev/crash - /proc/kcore - /dev/mem If the memory source is not specified on the commandline, AVML will iterate over the memory sources to find a functional source. NOTE: If the kernel feature kernel_lockdown is enabled, AVML will not be able to acquire memory. Tested Distributions: - Ubuntu: 12.04, 14.04, 16.04, 18.04, 18.10, 19.04, 19.10, 20.04, 21.04, 22.04 - Centos: 6.5, 6.6, 6.7, 6.8, 6.9, 6.10, 7.0, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.9 - RHEL: 6.7, 6.8, 6.9, 7.0, 7.2, 7.3, 7.4, 7.5, 7.7, 8.5, 9.0 - Debian: 8, 9, 10
A script for extracting common Windows artifacts from source images and VSCs with detailed dependencies and usage instructions.
A PowerShell-based incident response and live forensic data acquisition tool for Windows hosts.
WinSearchDBAnalyzer can parse and recover records in Windows.edb, providing detailed insights into various data types.
An open source digital forensic tool for processing and analyzing digital evidence with high performance and multiplatform support.
A collection of PowerShell modules for artifact gathering and reconnaissance of Windows-based endpoints.
A Cross-Platform Forensic Framework for Google Chrome that allows investigation of history, downloads, bookmarks, cookies, and provides a full report.