A curated list of awesome forensic analysis tools and resources

❄️ PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

WinDBG Anti-RootKit Extension

WhatsApp Parser Toolset v1.16

A collection of tools for forensic analysis

Python script to decode common encoded PowerShell scripts

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG files to see what an attacker did on a compromised host. It is extremely useful for a forensics team to extract timestamps after an attack on a host to collect evidences and perform further analysis.

Script to remove homoglyphs and zero-width characters to allow for safe distribution of documents from anonymous sources.

Awesome list of digital forensic tools

CLI utility and Python module for analyzing log files and other data.

An OSINT Metadata analyzing tool that filters through tags and creates reports

Rootkit Detector for UNIX

UAC (Unix-like Artifacts Collector) is a command line shell script that makes use of built-in tools to automate the collection of Unix-like systems artifacts. It was created to facilitate and speed up data collection, and depend less on remote support during incident response engagements. Supported systems: AIX, BSD, Linux, macOS and Solaris.

The Python implementation of the AFF4 standard.

Analyze and help extract older "hidden" versions of a pdf from the current pdf.

CIRCL system forensic tools or a jumble of tools to support forensic

Tools for inspecting VM disk images

Monitoring Registry and File Changes in Windows

Recover files from damaged BTRFS filesystems

A curated list of digital forensic tools.

Forensic Analysis Tool for Btrfs File System.

Simple Powershell scripts to collect all Windows Event Logs from a host and parse them into one CSV timeline.

Case Studies on Forensic Accounting using Data Analysis

CIFv3 Ubuntu 16.04 Docker Container (Bearded Avenger)

hook detector using emulation and comparing static with dynamic outputs

Repository containing several CTF write-ups

Logs Forensic Investigator SSH

A dedicated repo to interact with the API of Timesketch