APTSimulator

APT Simulator Important: Don't just ZIP download or clone the repo if you don't plan to develop some test. Use the package in the release which contains a packaged version with encrypted archives that don't contain cleartext samples and tools. APT Simulator is a Windows Batch script that uses a s...

StegoForge

🛡️ StegoForge The ultimate hybrid of steganography, digital forensics, and covert communications. ⚡ Quick Launch Standalone Binaries StegoForge is a complex Python framework, but you shouldn't have to deal with broken environments when doing active forensics. We have compiled zero-dependency,...

ForensicMiner

ForensicMiner v1.4 "ForensicMiner, Redefine DFIR Automations" Created & Maintained by: Eilay Yosfan What is ForensicMiner ? ForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations. Designed for efficiency, it automates artifact and evidence...

VolWeb

Introduction VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated to aiding in investigations and incident responses. 🧬 Objectives The goal of VolWeb is to enhance the efficiency of memory collection and forensic analysis by...

digital-forensics-lab

Digital Forensics Lab & Shared Cyber Forensic Intelligence Repository Features of Repository Interactive Digital Forensics Labs: Tailored for students and faculty engagement Linux-Centric Lab Environment: Utilizes Kali Linux exclusively for all labs Visual Learning Support: Each lab includes...

Refloow-Geo-Forensics

📍 Refloow™ Geo Forensics Official Github Repository Professional Open-Source OSINT & Digital Forensics Tool Version 1.4.0 Latest: Version 1.0.0 Launch: Refloow™ Geo Forensics is a high-performance, open-source digital forensics tool designed for investigators, OSINT practitioners, and security...

MacOSThreatTrack

MacOS ThreatTrack v2.0 Enhanced security information gathering tool for macOS systems with advanced threat detection capabilities. Description MacOSThreatTrack is a comprehensive bash-based security reconnaissance tool designed for proactive detection of malicious activity on macOS systems. This...

forensictools

forensictools is a toolkit designed for digital forensics, offering a wide array of tools. Its primary goal is to simplify the creation of a virtual environment for conducting forensic examinations. In addition to installing the tools, forensictools seamlessly integrates the programs into the...

dissect

dissect Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT part of NCC Group. This project is a meta package, it will install all other Dissect modules wi...

turbinia

Turbinia Summary Note: Turbinia will not develop new features anymore and is in maintenance mode. Users should have a look atOpenRelik. Turbinia is an open-source framework for deploying, managing, and running distributed forensic workloads. It is intended to automate running of common forensic...

libewf

libewf is a library to access the Expert Witness Compression Format EWF. Project information: Status: experimental Licence: LGPL-3.0-or-later Read or write supported EWF formats: SMART .s01 EWF-S01 EnCase .E01 EWF-E01 .Ex01 EWF2-Ex01 Not supported: .Ex01 EWF2-Ex01 bzip2 compression work in progre...

RecuperaBit

RecuperaBit A software which attempts to reconstruct file system structures and recover files. Currently it supports only NTFS. RecuperaBit attempts reconstruction of the directory structure regardless of: missing partition table unknown partition boundaries partially-overwritten metadata quick...

passivedns

| | @ | \ | \ | || | TM | |.------. .-----. .-----. -. .-.------. | |\ || | || | | | | || --'| --'| |\ Y /| --| | |/ || || | | || || ||||||| / | /|/ | |||| A tool to collect DNS records passively to aid Incident handling, Network Security Monitoring NSM and general digital forensics. PassiveDNS...

ESLockDecryptor

ESLockDecryptor ESLockDecryptor is a command-line tool designed to recover and decrypt files encrypted by ES File Explorer files with the .eslock extension. It supports processing both individual files and entire directories. !WARNING FOR LEGAL USE ONLY! This software is designed for educational...

dfir-orc

DFIR ORC !LGPL licensedimg-license French Cybersecurity Agency ANSSI This project is managed byANSSI. To find out more, you can visit the page in French dedicated to ANSSI’s open-source strategy. You can also click on the badges above to learn more about their meaning. Documentation...

bulk_extractor

bulkextractor is a high-performance digital forensics exploitation tool. It is a "get evidence" button that rapidly scans any kind of input disk images, files, directories of files, etc and extracts structured information such as email addresses, credit card numbers, JPEGs and JSON snippets witho...

CIRTKit

One DFIR console to rule them all. Built on top of theViper Framework Documentation Please see the wiki for more information about CIRTKit and documentation Roadmap Future integrations Bit9 Palo Alto Networks EnCase/FTK Future modules Packet Analysis possibly Dshell Javascript...

libvshadow

libvshadow is a library to access the Volume Shadow Snapshot VSS format. The VSS format is used by Windows, as of Vista, to maintain copies of data on a storage media volume. Project information: Status: alpha Licence: LGPL-3.0-or-later Also see: OSDFC 2012: Paper - Windowless Shadow Snapshots:...

Incident-Response-Powershell

Powershell Digital Forensics & Incident Response This repository provides PowerShell-based Incident Response scripts. DFIR Script The DFIR-Script.ps1 script collects forensic artifacts on Windows devices. Key features include: Collecting over 25 potential indicators of compromise. CSV-based expor...

Ivanti-Connect-Secure-Logs-Parser

Ivanti Secure Connect Logs Parser This repository provides a Python script designed to convert Ivanti Secure Connect .vc0 log files into CSV format for digital forensics and incident response. In particular, the parser: Extracts timestamps from Ivanti log files notably from .vc0 files. Converts...