fsmon

fsmon 适用于 Linux、Android、iOS 和 macOS 的底层文件系统监控工具。 作者 ：pancake @ nowsecure 许可证 ：MIT 设计目标用户： 系统管理员和事件响应人员 安全研究人员和取证分析师 调试 I/O 密集型应用的开发人员 对观察文件系统访问行为感兴趣的逆向工程师 安装 在 macOS 上，现在可以通过 brew 安装，命令如下： brew tap nowsecure/fsmon https://github.com/nowsecure/fsmon brew install nowsecure/fsmon/fsmon 或者直接运行...

ExtractUsnJrnl

NTFSの変更ジャーナルは $Extend$UsnJrnl にあるファイルです。これは通常のディレクトリ一覧では見つけることができず、通常の手段でも見つけられないシステムメタファイルです。関連データは $J という名前の代替データストリームにあります。もう一つ $Max と呼ばれるADSもありますが、これはほとんど無関係です。$J...

Judge-Jury-and-Executable

Judge Jury and Executable 脅威ハンティングフォレンジックツール 機能: マウントされたファイルシステムをすぐにスキャンして脅威を検出 または、インシデント前にシステムのベースラインを収集し、脅威ハンティング能力を強化 インシデントの前、最中、後に使用可能 1台から多数のワークステーションに対応 MFTをスキャンし、ファイルのアクセス許可、ファイルロック、OSのファイル保護/隠蔽/シャドウイングをバイパス 各ファイルについて最大51種類のプロパティを収集...

SentinelNav

SentinelNav SentinelNav 是一款零依赖、纯 Python 实现的二进制可视化与取证工具。它将二进制数据转换为交互式光谱图，使分析人员能够直观识别文件结构、熵异常、代码段以及潜在的加密数据块。 它结合了用于快速文件扫描的多进程后端，以及用于交互式探索、十六进制检查和架构指纹识别的本地 Web 前端。 快速开始 由于 SentinelNav 仅依赖 Python 标准库，因此无需安装任何外部包。 1. 将脚本保存为 sentinelnav.py。 2. 以交互模式运行脚本： python3 sentinelnav.py 3. 按提示将目标文件拖放到终端窗口中。 4...

usbrip

usbrip inherited from "USB Ripper", not "USB R.I.P." is a simple forensics tool with command line interface that lets you keep track of USB device artifacts i.e., USB event history on Linux machines. Table of Contents: Description Quick Start Showcase System Log Structure Dependencies deb pip...

routeros-scanner

RouterOS Scanner 用于 Mikrotik 设备的取证工具。搜索路由器上需要修复的可疑属性和薄弱安全点。 该工具的功能包括： 获取设备版本并将其映射到 CVE 检查计划任务 查找流量重定向规则 查找 DNS 缓存投毒 查找默认端口更改 查找非默认用户 查找可疑文件 查找代理、socks 和防火墙规则 执行与参数 该工具需要 Python 3.8 或更高版本。 安装所需的 Python 包 pip install -r requirements.txt 参数： 参数| 描述| 必需 / 可选 ---|---|--- -i| 被测 Mikrotik IP 地址| 必需 -p| ...

XWFAcropalypse

Acropalypse CVE-2023-21036 是 Google Pixel Markup 工具和 Windows 截图和草图（Snip & Sketch）中的一个安全漏洞，该漏洞允许从 PNG 截图中恢复已裁剪或编辑掉的数据。 该漏洞于 2023 年被发现，它使攻击者能够重建原始图像，即使文件已被用户覆盖保存过，也可能暴露+ 敏感且不可见的信息。 此 X-Ways Forensics XWF 扩展程序可检测存在此漏洞的图像文件，并将这些文件标记为“notable”（值得注意）。...

hayabusa v4.1.0

Windows event log fast forensics timeline generator and threat hunting tool. Written in memory-safe Rust by Yamato Security — the only open-source tool with full Sigma support, including v2 correlation rules. !https://img.shields.io/badge/SINCON%20Kampung%20Wor...

CVE-2026-17535 Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However...

CVE-2026-17535 Velociraptor Multiple Crashes in NTFS Parser when applied to invalid NTFS Volumes

Velociraptor's NTFS parsing library mishandles several out of bound and memory exhaustion bugs which may be triggered by maliciously crafted NTFS images. Typically Velociraptor's NTFS parser is used on live NTFS filesystems, limiting the opportunity of attackers corrupting the filesystem. However...

CVE-2026-11958 Local privilege escalation in ANSSI’s DFIR-ORC

Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and...

CVE-2026-46486

MVT Mobile Verification Toolkit helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.12, there is a path traversal vulnerability via unsanitized File identifiers in iOS Backup processing. This issue has been patched in version...

Hayabusa 跨站脚本漏洞

Hayabusa is an open-source Windows event log forensic and threat hunting tool developed by Yamato Security. Versions prior to Hayabusa 3.8.0 contained a cross-site scripting vulnerability. This vulnerability stemmed from HTML report outputs that had the same cross-site scripting vulnerabilities,...

uac 操作系统命令注入漏洞

UAC is a Unix system forensics and incident response tool developed by Thiago Canozzo Lahr. Versions of UAC prior to 3.3.0-rc1 contained a vulnerability related to operating system command injection. This vulnerability stemmed from the runcommand function, which directly passed the constructed...

Forensic journey: hunting evil within AmCache

Introduction When it comes to digital forensics, AmCache plays a vital role in identifying malicious activities in Windows systems. This artifact allows the identification of the execution of both benign and malicious software on a machine. It is managed by the operating system, and at the time o...

New Mobile Phone Forensics Tool

The Chinese have a new tool called Massistant. Massistant is the presumed successor to Chinese forensics tool, "MFSocket", reported in 2019 and attributed to publicly traded cybersecurity company, Meiya Pico. The forensics tool works in tandem with a corresponding desktop software. Massistant gai...

BlueRiSC WindowsSCOPE Cyber Forensics 数据伪造问题漏洞

BlueRiSC WindowsSCOPE Cyber Forensics is a GUI-based memory forensic capture and analysis toolkit from BlueRiSC. BlueRiSC WindowsSCOPE Cyber Forensics suffers from a Data Forgery Issue vulnerability that stems from a lack of constraints in the rv32im circuit, which could lead to a malicious prove...

Bringing Forensic Readiness to Modern Computer Firmware

Today's computer systems come with a pre-installed tiny operating system, which is also known as UEFI. UEFI has slowly displaced the former legacy PC-BIOS while the main task has not changed: It is responsible for booting the actual operating system. However, features like the network stack make ...

What Graykey Can and Can’t Unlock

This is from 404 Media: The Graykey, a phone unlocking and forensics tool that is used by law enforcement around the world, is only able to retrieve partial data from all modern iPhones that run iOS 18 or iOS 18.0.1, which are two recently released versions of Apple's mobile operating system,...

Cellebrite UFED Input Validation Error Vulnerability

Cellebrite UFED is a universal forensic product from Cellebrite Israel. The product is mainly used for data extraction, transmission and analysis of devices. An input validation error vulnerability exists in Cellebrite UFED versions 5.0 through 7.5.0.845, which can be exploited by an attacker to...