IRTriage Logo

IRTriage

0
Free
Visit Website

Incident Response Triage is a scripted collection tool that automatically runs as an administrator in Windows versions, except WinXP, to gather system information valuable to a Forensic Analyst. It collects system information, network information, registry hives, disk information, and dumps memory, providing fast forensics in situations where a full disk image is not feasible.

FEATURES

ALTERNATIVES

A collection of PowerShell modules for artifact gathering and reconnaissance of Windows-based endpoints.

iOS Mobile Backup Xtractor tool for extracting iOS backups.

Stegextract is a Bash script that extracts hidden files and strings from images, supporting PNG, JPG, and GIF formats.

Dump iOS Frequent Locations from StateModel#.archive files.

Autopsy is a GUI-based digital forensics platform for analyzing hard drives and smart phones, with a plug-in architecture for custom modules.

DFIR ORC Documentation provides detailed instructions for setting up the build environment and deploying the tool.

A file search and query tool for ops and security experts.

A script to extract subdomains/emails for a given domain using SSL/TLS certificate dataset on Censys.