scalpel

Desde el 27/6/2013, Scalpel se ha liberado bajo la Licencia Apache 2.0 y el código fuente está disponible en el repositorio de GitHub de The Sleuth Kit. No se mantiene activamente. El equipo de Autopsy comenzó a trabajar en él para integrarlo estrechamente mediante enlaces Java/JNI, pero se...

BSOD_bitlocker_recover

Herramienta de extracción de VMK de BitLocker Este script de Python te ayuda a extraer posibles Claves Maestras de Volumen VMK de BitLocker a partir de archivos de volcado de memoria, como los generados por una Pantalla Azul de la Muerte BSOD. Es una utilidad de línea de comandos diseñada para...

Filedumper

FileDumper - Memory Forensic Dumper FileDumper v1.0.1 A simple, powerful tool to dump files directly from process memory regions. Created in a late-night collaboration between human ingenuity and AI creativity — xAI's Grok + Kadir Isbirligi 2026 "Bir gece sohbet ettik, kod yazdık, masaya yumruk...

foremost

FOREMOST Foremost es un programa de Linux para recuperar archivos basándose en sus cabeceras y pies. Foremost puede trabajar con archivos de imagen, como los generados por dd, Safeback, Encase, etc., o directamente sobre una unidad. Las cabeceras y los pies se especifican mediante un archivo de...

sleuthkit

The Sleuth Kit INTRODUCTION The Sleuth Kit is an open source forensic toolkit for analyzing Microsoft and UNIX file systems and disks. The Sleuth Kit enables investigators to identify and recover evidence from images acquired during incident response or from live systems. The Sleuth Kit is open...

DeadMatter

DeadMatter DeadMatter es una herramienta especializada escrita en C, diseñada para extraer información sensible, como hashes de contraseñas de sesiones de inicio de sesión activas, a partir de volcados de memoria. Emplea técnicas de carving para recuperar credenciales de diversos tipos de archivo...

memory-carving-scripts

Este repositorio no tiene un README...

radare2-scripts

radare2 Scripts Summary A 'collection' of scripts to be used with radare2. r2bincarver.py - A script used to carve files from memory dumps. r2hashfuncdecoder.py - A script used to decode hashed functions, commonly found in shellcode. Scripts Binary Carver This script will carve files from memory...

psa-2026-00043-recovery

psa-2026-00043-recovery Recuperación de un wiper que se presentó como ransomware, tras un ataque contra infraestructura Proxmox expuesta a internet PSA-2026-00043-1 / CVE-2023-54391. El atacante borró los invitados y dejó los sistemas de archivos dañados. Dos vías de recuperación según el tipo de...

zipdefrag

Este volcado es un rompecabezas o parseo avanzado a escopetazos para necios y rebeldes érase una vez Érase una vez, querido lector, en una noche oscura y tormentosa, su fiel autor se topó con una situación desconcertante y misteriosa: un sistema donde lo único que impedía el análisis de memoria p...

CVE-2026-70378

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

CVE-2026-70378

imagecli's carve pipeline operation Carve::apply in src/imageops.rs only asserts ratio = 1.0, never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to...

CVE-2026-70378

The CVE describes imagecli: negative values for carve ratio in Carve::apply() (src/image_ops.rs) are not validated to be positive. With ratio <= 1.0 only asserted, a negative ratio can drive the computed target width to 0 via Rust’s float-to-uint cast, then be passed to imageproc::seam_carving...

CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

CVE-2026-70378 imagecli - Negative carve Ratio Bypasses Bounds Check and Crashes Process via Reachable Panic

imagecli's pipeline operation Carve::apply in src/imageops.rs only asserts , never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seamcarving::shrinkwidth —...

EUVD-2026-53198

imagecli's carve pipeline operation Carve::apply in src/imageops.rs only asserts ratio = 1.0, never validating that the ratio is positive. A negative ratio e.g. -5 causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to...

PT-2026-68038

Name of the Vulnerable Software and Affected Versions imagecli affected versions not specified Description The carve pipeline operation fails to validate that the ratio variable is positive. When a negative value is provided, the computed target width saturates to 0 during a float-to-uint cast...

Byte-Level Generative Predictions for Forensics Multimedia Carving

Digital forensic investigations often face significant challenges when recovering fragmented multimedia files that lack file system metadata. While traditional file carving relies on signatures and discriminative deep learning models for fragment classification, these methods cannot reconstruct o...

AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation

The National Institute of Standards and Technology NIST Computer Forensic Tool Testing CFTT programme has become the de facto standard for providing digital forensic tool testing and validation. However to date, no comprehensive framework exists to automate benchmarking across the diverse forensi...