scalpel

As of 6/27/2013 Scalpel has been released under the Apache 2.0 License and the source is available at The Sleuth Kit github repository. It is not being actively maintained. The Autopsy team started to do work on it to integrate tightly into via Java/JNI bindings, but ran into several memory leaks...

radare2-scripts

radare2 Scripts Summary A 'collection' of scripts to be used with radare2. r2bincarver.py - A script used to carve files from memory dumps. r2hashfuncdecoder.py - A script used to decode hashed functions, commonly found in shellcode. Scripts Binary Carver This script will carve files from memory...

Filedumper

FileDumper - Memory Forensic Dumper FileDumper v1.0.1 A simple, powerful tool to dump files directly from process memory regions. Created in a late-night collaboration between human ingenuity and AI creativity — xAI's Grok + Kadir Isbirligi 2026 "Bir gece sohbet ettik, kod yazdık, masaya yumruk...

foremost

FOREMOST Foremost is a Linux program to recover files based on their headers and footers. Foremost can work on image files, such as those generated by dd, Safeback, Encase, etc, or directly on a drive. The headers and footers are specified by a configuration file, so you can pick and choose which...

zipdefrag

This Dump Is A Puzzle or Advanced Shotgun Parsing for Fools and Rebels il était une fois Once upon a time, dear reader, on a dark and stormy night, your faithful author stumbled upon a perplexing and mysterious situation - a system where the only thing preventing chip off memory analysis and...

AutoDFBench 1.0: A Benchmarking Framework for Digital Forensic Tool Testing and Generated Code Evaluation

The National Institute of Standards and Technology NIST Computer Forensic Tool Testing CFTT programme has become the de facto standard for providing digital forensic tool testing and validation. However to date, no comprehensive framework exists to automate benchmarking across the diverse forensi...

BruteShark - Network Analysis Tool

BruteShark is a Network Forensic Analysis Tool NFAT that performs deep processing and inspection of network traffic mainly PCAP files, but it also capable of directly live capturing from a network interface. It includes: password extracting, building a network map, reconstruct TCP sessions, extra...