ALFA

ALFA Automated Audit Log Forensic Analysis for Google Workspace Copyright c 2026 Invictus Incident Response Original authors Greg Charitonos & BertJanCyber maintained by Invictus Incident Response Before you start A note on supported operating systems, ALFA is tested on several Linux distribution...

columbo

Columbo Columbo is a computer forensic analysis tool used to simplify and identify specific patterns in compromised datasets. It breaks down data to small sections and uses pattern recognition and machine learning models to identify adversaries behaviour and their possible locations in compromise...

MozCache

MozCache Bash script Simple shell script to perform forensic analysis of the Mozilla-Browsers cache Firefox, Iceweasel and Seamonkey. The script orders by date the files cached from a browser of the Mozilla family using the cache version 2. Together with the name of each file the script generates...

physical-analyzer-scripts

physical-analyzer-scripts Cellebrite Physical Analyzer python scripts to aid analysts with extended functionality...

DFIR_Resources_REvil_Kaseya

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack Yesterday Sophos and Huntress Labs identified that Kaseya, a remote management provider popular with MSPs, was compromised to deploy a supply chain ransomware attack. A large number of organisations wer...

forensic-msvpn

Microsoft Remote Access VPN Forensic analysis This repository contains resources related to the forensic analysis made on Microsoft Remote Access VPN and available on this blog post: https://www.synacktiv.com/publications/forensic-aspects-of-microsoft-remote-access-vpn.html. a Velociraptor client...

RdpCacheStitcher

RdpCacheStitcher RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools https://github.com/ANSSI-FR/bmc-tools as input, it provides a graphical user...

bytesrevealer

https://bytesrevealer.online/ VULNEX https://www.vulnex.com/ Bytes Revealer Version: 0.4 Bytes Revealer is a powerful reverse engineering and binary analysis tool designed for security researchers, forensic analysts, and developers. With features like hex view, visual representation, string...

awesome-android-security

Awesome-Android-Security Table of Contents Blog How To's Papers Books Trainings Tools Static Analysis Tools Dynamic Analysis Tools Online APK Analyzers Online APK Decompiler Forensic Analysis Tools Labs Talks Misc Bug Bounty & Writeups Cheat Sheet Checklist Bug Bounty Report Blogs 1-click Exploit...

lmg

Linux Memory Grabber Linux 메모리 덤프 및 VolatilityTM 프로필을 생성하는 스크립트. Hal Pomeranz [email protected], 2020-02-01 감사의 말 "만약 내가 더 멀리 보았다면, 그것은 거인의 어깨 위에 서 있었기 때문이다." 아이작 뉴턴 이 간단한 도구를 가능하게 만든 많은 분들께 감사드립니다: -- AVML을 제공해 주신 Microsoft의 좋은 분들 -- LiME 작업을 해 주신 Joe Sylve -- 지속적으로 작업을 이어오고 있는...

prefetch-hash-cracker

Prefetch Hash Cracker Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While its content may not be recoverable, the filename itself is often enough to find the full path of the executable for which the prefetch file was created. Usin...

wireshark-forensics-plugin

wireshark-forensics-plugin Wireshark is the most widely used network traffic analyzer. It is an important tool for both live traffic analysis & forensic analysis for forensic/malware analysts. Even though Wireshark provides incredibly powerful functionalities for protocol parsing & filtering, it...

Remote-Desktop-Caching-

Remote-Desktop-Caching- このツールを使用すると、破損したPNGファイルの形で古いRDP（mstsc）セッション情報を復元できます。これらのPNGファイルにより、Red TeamのメンバーはLAPSパスワードや画面上の機密情報などの有益な情報を抽出できます。Blue TeamのメンバーはPNGファイルを再構築して、攻撃者が侵害されたホストで何をしたかを確認できます。フォレンジックチームがホストへの攻撃後にタイムスタンプを抽出し、証拠を収集してさらなる分析を行うために非常に役立ちます。 Any suggestions or ideas for this tool ar...

DFIR-O365RC

Table of contents: 1. Module description 2. Installation and prerequisites 1. Using Docker 2. Manual Installation 3. Managing the DFIR-O365RC application 1. Creating the application 2. Updating the application 3. Removing the application 4. Permissions and license requirements 5. Functions includ...

interrogate

Interrogate Interrogate is a proof-of-concept tool for identification of cryptographic keys in binary material regardless of target operating system, first and foremost for memory dump analysis and forensic usage. Able to identify AES, Serpent, Twofish and DER-encoded RSA keys as of version 0.0.4...

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis

joomla-cve-2015-8562-exploit-and-linux-forensic-analysis...

FAMA

OBSOLETO: LabCIF - Análisis Forense para Aplicaciones Móviles Comenzando Marco de extracción y análisis para Android con un módulo Autopsy integrado. Extraiga fácilmente datos de usuario de un dispositivo y genere informes potentes para Autopsy o aplicaciones externas. Funcionalidades Extraer dat...

PacketStreamer

PacketStreamer Deepfence PacketStreamer is a high-performance remote packet capture and collection tool. It is used by Deepfence's ThreatStryker security observability platform to gather network traffic on demand from cloud workloads for forensic analysis. Primary design goals: Stay light, captur...

iOSForensic

iOSForensic iosForensic is a python tool to help in forensics analysis on iOS. It get files, logs, extract sqlite3 databases and uncompress .plist files in xml. Installation Simply clone this git repository and install dependencies. Dependencies Linux OpenSSH sshpass sqlite3 python = 2.6...

hassh

"HASSH" - a Profiling Method for SSH Clients and Servers. NOTE: This Corelight repository was created so that it can be actively maintained, as per a request from Salesforce whose original repository is not being maintained. "HASSH" is a network fingerprinting standard which can be used to identi...