AoratosWin

AoratosWin AoratosWin is a tool that removes traces of executed applications on Windows OS which can easily be listed with tools such as ExecutedProgramList by Nirsoft. Feel free to decompile, reverse, redistribute, etc. Supported OS Tested On Windows 7 x86, x64 Windows 8 x86, x64 Windows 8.1 x86...

LiMEaide

LiMEaide v2.0 by Daryl Bennett - kd8bnyatgmaildotcom About LiMEaide is a python application designed to remotely or locally dump RAM of a Linux client and create a volatility profile for later analysis on your local host. I hope that this will simplify Linux digital forensics in a remote...

DFIRArtifactMuseum

DFIR Artifact Museum Description The DFIR Artifact Museum is a community-driven archive of DFIR-related artifacts. It was created to provide a centralized location for examples of artifacts from various operating systems. Purpose To increase accessibility to sample artifacts without individual...

MemProcFS

MemProcFS: MemProcFS is an easy and convenient way of viewing physical memory as files in a virtual file system. Easy trivial point and click memory analysis without the need for complicated commandline arguments! Access memory content and artifacts via files in a mounted virtual file system or v...

beagle

Beagle 1. About Beagle 2. Installation 1. Docker 2. Python Package 3. Configuration 3. Web Interface 1. Uploading Data 2. Browsing Existing Graphs 3. Graph Interface 1. Inspecting Nodes and Edges 2. Expanding Neighbours 3. Hiding Nodes 4. Running Mutators 5. Toggling Node and Edge Types 6...

PcapXray

PcapXray A network forensics tool — visualize PCAP files or live traffic as an annotated network diagram with device identification, protocol classification, Tor detection, and malicious traffic flagging. Module Overview graph TD UIuserinterface.py\nGUI controller -- PRpcapreader\nFile + Live...

Memory-analysis

Memory-analysis Contains tools to perform malware and forensic analysis in Memory. Plugins: Dyrescan.py - parses Dyreconfig in memory. Rat9002.py - parses 9002 rat config in memory. plugx.py - parses plugx config in memory modified to also parse config size: 0x170c. ghostrat.py - parses ghostrat...

pmd

PMD - source code analyzer PMD is an extensible multilanguage static code analyzer. It finds common programming flaws like unused variables, empty catch blocks, unnecessary object creation, and so forth. It's mainly concerned with Java and Apex , but supports 16 other languages. It comes with 400...

passivedns

| | @ | \ | \ | || | TM | |.------. .-----. .-----. -. .-.------. | |\ || | || | | | | || --'| --'| |\ Y /| --| | |/ || || | | || || ||||||| / | /|/ | |||| A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring NSM and general digital forensics. PassiveDNS...

ExtractUsnJrnl

The change journal on NTFS is a file found at $Extend$UsnJrnl. It is a system metafile that is not possible to find in a normal dir listing, or even posible to by regular means. The relevant data is found in the alternate data stream named $J. There's also another ADS called $Max which is rather...

dwarf2json

Introduction dwarf2json is a Go utility that processes files containing symbol and type information to generate Volatility3 Intermediate Symbol File ISF JSON output suitable for Linux and macOS analysis. To build Go 1.18+ required: $ go build To run: $ ./dwarf2json --help Usage: ./dwarf2json...

refinery

Binary Refinery docs tests codecov pypi High Octane Triage Analysis || || || || || | / / / \ || ==||=====|| | / |/ \ /==| / \ ===| '======|| | \ | | \ | \ /| | || || /||/ / | | | || =========''====/=========/ /==||=====||======' \ / / The Binary Refinery™ is a collection of Python scripts...

Santoku-Linux

Mobile Forensics, Malware Analysis, and App Security Testing SLICE AND DICE Boot into Santoku and get to work, with the latest security tools and utilities focused on mobile platforms such as Android and iOS. Santoku Linux is a bootable Linux ISO which you can run as Live CD or install on a PC/VM...

aiengine

AIEngine Artificial Intelligent Engine AIEngine is a next generation interactive/programmable Python/Ruby/Java/Lua and Go network intrusion detection system engine with capabilities of learning without any human intervention, DNS domain classification, Spam detection, network collector, network...

Refloow-Geo-Forensics

📍 Refloow™ Geo Forensics Official Github Repository Professional Open-Source OSINT & Digital Forensics Tool Version 1.4.0 Latest: Version 1.0.0 Launch: Refloow™ Geo Forensics is a high-performance, open-source digital forensics tool designed for investigators, OSINT practitioners, and security...

libvshadow

libvshadow is a library to access the Volume Shadow Snapshot VSS format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume. Project information: Status: alpha Licence: LGPL-3.0-or-later Also see: OSDFC 2012: Paper - Windowless Shadow Snapshots:...

LinuxForensics

Linux Forensics Everything related to Linux Forensics Note: for better navigation, please visit the repo's main page here Index Talks Workshops Current Team Members: Ali Hadi, Twitter Mariam Khader, Twitter, 2019 - present Alayna Cash, Linux GUI Environments, 2022 - present Tom Claflin, Twitter,...

ForensicMiner

ForensicMiner v1.4 "ForensicMiner, Redefine DFIR Automations" Created & Maintained by: Eilay Yosfan What is ForensicMiner ? ForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations. Designed for efficiency, it automates artifact and evidence...

Live-Forensicator

🛡️ Forensicator Artifact Collector 🛡️ Cross-platform Forensic Artifact Collector Windows | Linux | macOS | Network Devices Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review. 🤔 About Live...

Creds

Creds Some usefull Scripts and Executables for Pentest & Forensics Most Scripts/Executables are Windows / Domain specific. Legal disclaimer: Usage of theese Scripts/Executables for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable...