Diffy (DEPRECATED) Logo

Diffy (DEPRECATED)

0
Free
Visit Website

Diffy has been deprecated at Netflix. This software is no longer maintained or supported. Diffy is a digital forensics and incident response (DFIR) tool that was developed by Netflix's Security Intelligence and Response Team (SIRT). Diffy allows a forensic investigator to quickly scope a compromise across cloud instances during an incident, and triage those instances for followup actions. Diffy is currently focused on Linux instances running within Amazon Web Services (AWS), but owing to our plugin structure, could support multiple platforms and cloud providers. It's called "Diffy" because it helps a human investigator to identify the differences between instances, and because Alex pointed out that "The Difforensicator" was unnecessarily tricky. See Releases for recent changes. See our Read the Docs site for well-formatted documentation. Supported Technologies: AWS (AWS Systems Manager / SSM), Local osquery. Each technology has its own plugins for targeting, collection, and persistence. Features: Efficiently highlights outliers in security-relevant instance behavior. For example, you can use Diffy to tell you which of your instances are listening on an unexpected port.

FEATURES

ALTERNATIVES

A powerful OSINT tool for creating custom templates for data extraction and analysis

A framework/scripting tool to standardize and simplify the process of scripting favorite Live Acquisition utilities for Incident Responders.

Tool for parsing NTFS journal files, $Logfile, and $MFT.

WinSearchDBAnalyzer can parse and recover records in Windows.edb, providing detailed insights into various data types.

Analyse a forensic target to find and report files found and not found in hashlookup CIRCL public service.

GVfs is a userspace virtual filesystem implementation for GIO with various backends and features.

A tool for parsing and extracting information from the Master File Table of NTFS file systems.

An open source format for storing digital evidence and data, with a C/C++ library for creating, reading, and manipulating AFF4 images.

PINNED