kube-forensics Logo

kube-forensics

0
Free
Visit Website

kube-forensics allows a cluster administrator to create checkpoint snapshots of the state of running pods for later off-line analysis by dumping the current state of a running pod and all its containers, enabling security professionals to perform detailed forensic analysis in the event of a security breach.

FEATURES

ALTERNATIVES

Review of various MFT parsers used in digital forensics for analyzing NTFS file systems.

A tool for parsing and extracting information from the Master File Table of NTFS file systems.

A library to access and manipulate RAW image files.

DMG2IMG is a tool for converting Apple compressed dmg archives to standard image disk files with support for zlib, bzip2, and LZFSE compression.

Powerful tool for searching and hunting through Windows forensic artefacts with support for Sigma detection rules and custom Chainsaw detection rules.

Diffy is a digital forensics and incident response (DFIR) tool developed by Netflix's Security Intelligence and Response Team (SIRT) for scoping compromises across cloud instances.

Python tool for remote memory acquisition

MalConfScan is a Volatility plugin for extracting configuration data of known malware and analyzing memory images.