analyzeMFT

AnalyzeMFT Status : All tests passing across Python 3.8-3.12 on Windows, macOS, and Linux. Quick Start root@kitploit: Install pip install analyzeMFT Basic usage python analyzeMFT.py -f MFTFILE -o output.csv --csv Generate test MFT for testing python -c "from src.analyzeMFT.testgenerator import...

factual-rules-generator

factual-rules-generator Factual-rules-generator is an open source project which aims to generate YARA rules about installed software from a running operating system. The goal of the software is to be able to use a set of rules against collected or acquired digital forensic evidences and find...

bulk_extractor

bulkextractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input disk images, files, directories of files, etc and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets witho...

forensictools

forensictools is a toolkit designed for digital forensics, offering a wide array of tools. Its primary goal is to simplify the creation of a virtual environment for conducting forensic examinations. In addition to installing the tools, forensictools seamlessly integrates the programs into the...

dissect

dissect Dissect es un framework y conjunto de herramientas de respuesta a incidentes y forense digital que permite acceder y analizar rápidamente artefactos forenses de varios formatos de disco y archivo, desarrollado por Fox-IT parte de NCC Group. Este proyecto es un paquete meta, que instalará...

DroneXtract

About DroneXtract is a comprehensive digital forensics suite for DJI drones made with Golang. It can be used to analyze drone sensor values and telemetry data, visualize drone flight maps, audit for criminal activity, and extract pertinent data within multiple file formats. Preview Features...

columbo

Columbo Columbo es una herramienta de análisis forense informático utilizada para simplificar e identificar patrones específicos en conjuntos de datos comprometidos. Descompone los datos en secciones pequeñas y utiliza reconocimiento de patrones y modelos de aprendizaje automático para identifica...

Telegrip

Hi there 👋 Telegrip is a GUI digital forensic tool that deals with Telegram-related cases. Telegrip provides several features: 1. Telegrip acquires sparse image from Android devices containing the device information and all Telegram-related data. 2. Parses and analyzes all types of messages,...

beagle

Beagle 1. Acerca de Beagle 2. Instalación 1. Docker 2. Paquete Python 3. Configuración 3. Interfaz web 1. Subir datos 2. Navegar por grafos existentes 3. Interfaz de grafo 1. Inspeccionar nodos y aristas 2. Expandir vecinos 3. Ocultar nodos 4. Ejecutar mutadores 5. Alternar tipos de nodos y arist...

ir-rescue

ir-rescue ir-rescue is composed of two sister scripts that collect a myriad of forensic data from 32-bit and 64-bit Windows systems ir-rescue-win and from Unix systems ir-rescue-nix. The scripts respect the order of volatility and artifacts that are changed with the execution e.g. , prefetch file...

imago-forensics

imago-forensics 🕵️ Imago es una herramienta Python que extrae evidencias digitales de imágenes de forma recursiva. Esta herramienta es útil durante una investigación forense digital. Si necesitas extraer evidencias digitales y tienes muchas imágenes, a través de esta herramienta podrás compararlas...

plaso

Plaso Plaso Langar Að Safna Öllu - super timeline para todas las cosas Plaso Plaso Langar Að Safna Öllu, o super timeline para todas las cosas , es un motor basado en Python utilizado por varias herramientas para la creación automática de líneas de tiempo. El comportamiento predeterminado de Plas...

windows-malware-behavioral-analysis

Behavioral Malware Analysis using REMnux & FLARE-VM A practical Blue Team malware investigation demonstrating how suspicious Windows executables can be analyzed safely inside an isolated laboratory using behavioral analysis techniques. Rather than reverse engineering malware source code, this...

DFIR-LABS

About DFIR LABS is a compilation of challenges that aims to provide practice in simple to advanced concepts in the following topics: Digital Forensics, Incident Response, Malware Analysis and Threat Hunting. This is aimed at Professionals, Security Researchers, Students, CTF Players as well as DF...

ForensiX

⬡ ForensiX — Digital Forensics Intelligence Framework Created by Ameer Rasim | Version 2.0.0 root@kitploit: ███████╗ ██████╗ ██████╗ ███████╗███╗ ██╗███████╗██╗██╗ ██╗ ██╔════╝██╔═══██╗██╔══██╗██╔════╝████╗ ██║██╔════╝██║╚██╗██╔╝ █████╗ ██║ ██║██████╔╝█████╗ ██╔██╗ ██║███████╗██║ ╚███╔╝ ██╔══╝ ██...

KapeFiles

KAPE Files Community-created Targets and Modules for use with KAPE Download KAPE · Report a Bug · Request Feature KapeFiles KAPE Overview KAPE is an efficient and highly configurable triage program that will target essentially any device or storage location, find forensically useful artifacts, an...

dfir-orc

DFIR ORC French Cybersecurity Agency ANSSI This project is managed byANSSI. To find out more, you can visit the page in French dedicated to ANSSI’s open-source strategy. You can also click on the badges above to learn more about their meaning. Documentation https://dfir-orc.github.io Build Status...

StegoLab

🕵️ StegoLab – All-in-One Image Steganography Toolkit StegoLab is a lightweight, all-in-one image steganography analysis suite built for CTFs, cybersecurity challenges, and digital forensics. It automates the use of popular tools like binwalk, steghide, stegseek, zsteg, exiftool, and more — all in ...

LinuxForensics

Linux Forensics Everything related to Linux Forensics Note: for better navigation, please visit the repo's main page here Index Talks Workshops Current Team Members: Ali Hadi, Twitter Mariam Khader, Twitter, 2019 - present Alayna Cash, Linux GUI Environments, 2022 - present Tom Claflin, Twitter,...

DFIRArtifactMuseum

DFIR Artifact Museum Description The DFIR Artifact Museum is a community-driven archive of DFIR-related artifacts. It was created to provide a centralized location for examples of artifacts from various operating systems. Purpose To increase accessibility to sample artifacts without individual...