Top 146 forensics open source projects

Timeline of Active Directory changes with replication metadata

✭ 252

powershell windows timeline dfir forensics active-directory

inVtero.net: A high speed (Gbps) Forensics, Memory integrity & assurance. Includes offensive & defensive memory capabilities. Find/Extract processes, hypervisors (including nested) in memory dumps using microarchitechture independent Virtual Machiene Introspection techniques

✭ 237

reverse-engineering virtual-machine forensics cloud-computing hypervisor memory-hacking

Radare2

UNIX-like reverse engineering framework and command-line toolset

✭ 15,412

c Makefile C++shell Meson HTML hacktoberfest security reverse-engineering malware-analysis forensics commandline disassembler binary-analysis radare2

Userline

Query and report user logons relations from MS Windows Security Events

✭ 221

python docker dockerfile elasticsearch graph csv login neo4j dfir forensics

Blackhat Arsenal Tools

Official Black Hat Arsenal Security Tools Repository

✭ 2,639

hacking security-tools webapp hacking-tool security-scanner forensics blackhat arsenal ics-scada

Forensic Tools

A collection of tools for forensic analysis

✭ 204

python chrome firefox facebook metadata parse whatsapp forensics cookie exif facebook-messenger digital-forensics skype

Fatcat

FAT filesystems explore, extract, repair, and forensic tool

✭ 201

filesystem system forensics disk recovery

Whatsdump

Extract WhatsApp private key from any non-rooted Android device (Android 7+ supported)

✭ 198

python android whatsapp forensics

Pypowershellxray

Python script to decode common encoded PowerShell scripts

✭ 192

python powershell shellcode security security-tools dfir forensics incident-response

Ctf Tools

Useful CTF Tools

✭ 190

linux reverse-engineering networking cryptography unix cheatsheet ctf forensics

Linuxforensics

Everything related to Linux Forensics

✭ 189

linux dfir forensics digital-forensics

Rebel Framework

Advanced and easy to use penetration testing framework 💣🔎

✭ 183

python hacking reverse-engineering security-tools ctf malware-analysis reconnaissance vulnerability-scanners decoder kali-linux forensics trace vulnerability-detection decompiler mitm information-security vulnerability-assessment checksum

Remote Desktop Caching

This tool allows one to recover old RDP (mstsc) session information in the form of broken PNG files. These PNG files allows Red Team member to extract juicy information such as LAPS passwords or any sensitive information on the screen. Blue Team member can reconstruct PNG files to see what an attacker did on a compromised host. It is extremely useful for a forensics team to extract timestamps after an attack on a host to collect evidences and perform further analysis.

✭ 171

python hacking penetration-testing redteam forensics blueteam

Joincap

Merge multiple pcap files together, gracefully.

✭ 159

go command-line network network-analysis forensics commandline pcap sysadmin

Siem

SIEM Tactics, Techiques, and Procedures

✭ 157

security analysis monitor log recon forensics threat-hunting scan response siem baseline threat

Awesome Forensicstools

Awesome list of digital forensic tools

✭ 120

awesome awesome-list metadata forensics digital-forensics

Sleuthkit

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

✭ 1,948

c java C++M4 python perl forensics incident-response ntfs sleuthkit tct

C Aff4

An AFF4 C++ implementation.

✭ 126

forensics digital-forensics

Mba

Malware Behavior Analyzer

✭ 125

c malware forensics qemu sandbox program-analysis

Timesketch

Collaborative forensic timeline analysis

✭ 1,795

python Vue Jupyter Notebook javascript shell SCSS security analysis timeline dfir forensics

Hibr2bin

Comae Hibernation File Decompressor

✭ 116

security forensics

Invoke Liveresponse

Invoke-LiveResponse

✭ 115

powershell dfir forensics incident-response

Awesome Hacking

Awesome hacking is an awesome collection of hacking tools.

✭ 1,802

python Makefile security hacking security-tools penetration-testing malware forensics curated-list hacking-tools

Oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

✭ 1,848

python Rich Text Format HTML security parser malware-analysis forensics rtf compound pyparsing olefile ms-office-documents ole-files

Information Security Tasks

This repository is created only for infosec professionals whom work day to day basis to equip ourself with uptodate skillset, We can daily contribute daily one hour for day to day tasks and work on problem statements daily, Please contribute by providing problem statements and solutions

✭ 108

html pentesting osint malware-analysis redteam forensics incident-response compliance information-security blueteam steganography auditing

Rifiuti2

Windows Recycle Bin analyser

✭ 100

c windows forensics

Artifacts Kit

Pseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.

✭ 99

shellcode generator malware forensics dll kit header pe

Gohacktools

Hacker tools on Go (Golang)

✭ 1,303

go golang hack security tools scanner forensics bruteforce beginner hackers

Pentesting toolkit

🏴‍☠️ Tools for pentesting, CTFs & wargames. 🏴‍☠️

✭ 1,268

c linux hacking reverse-engineering network cryptography pentesting infosec ctf vulnerabilities forensics post-exploitation web-security steganography

Image Copy Move Detection

Copy-move forgery detection on digital image using Python

✭ 85

python image-processing forensics

Tcpflow

TCP/IP packet demultiplexer. Download from:

✭ 1,231

forensics digital-forensics

Autopsy

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

✭ 1,183

java forensics

Mobile Revelator

✭ 69

python forensics

Etl Parser

Event Trace Log file parser in pure Python

✭ 66

python windows dfir forensics

Icpr2020dfdc

Video Face Manipulation Detection Through Ensemble of CNNs

✭ 64

jupyter-notebook forensics

Metaforge

An OSINT Metadata analyzing tool that filters through tags and creates reports

✭ 63

python python3 security-tools osint infosec metadata forensics meta

Dfw1n Osint

Australian Open Source Intelligence Gathering Resources, Australias Largest Open Source Intelligence Repository for Cyber Professionals and Ethical Hackers

✭ 63

cryptography opensource osint cybersecurity social-network social-media forensics intelligence

Bramble

Bramble is a hacking Open source suite.

✭ 60

html cryptography hacking-tool forensics steganography

Pcapxray

❄️ PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction

✭ 1,096

python security network cybersecurity tor forensics pcap traffic packets

Autotimeliner

Automagically extract forensic timeline from volatile memory dump

✭ 54

python dfir forensics

Plaso

Super timeline all the things

✭ 1,055

python parsing timeline forensics

Mftecmd

Parses $MFT from NTFS file systems

✭ 45

forensics

Amt Forensics

Retrieve Intel AMT's Audit Log from a Linux machine without knowing the admin user's password.

✭ 37

python linux forensics intel

Firefed

🕵️ A tool for Firefox profile analysis, data extraction, forensics and hardening

✭ 37

python security privacy firefox forensics

Pcapfs

A FUSE module to mount captured network data

✭ 17

fuse forensics pcap

Tr1pd

tamper resistant audit log

✭ 13

rust security forensics intrusion-detection

Gensum

Powerful checksum generator!

✭ 12

shell bash forensics md5 sha1 sha256 checksum

Kaudit

Alcide Kubernetes Audit Log Analyzer - Alcide kAudit

✭ 23

shell security kubernetes security-tools vault forensics

Usbrip

Tracking history of USB events on GNU/Linux

✭ 903

python security forensics usb-devices

Memlabs

Educational, CTF-styled labs for individuals interested in Memory Forensics

✭ 696

shell security windows ctf cybersecurity dfir forensics digital-forensics

Hindsight

Web browser forensics for Google Chrome/Chromium

✭ 589

python chrome dfir forensics google-chrome

Diffy

Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

✭ 555

python security dfir forensics

Operative Framework

operative framework is a OSINT investigation framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules.

✭ 511

go golang framework osint scraper whatsapp phone enterprise forensics linkedin fingerprint

Seqbox

A single file container/archive that can be reconstructed even after total loss of file system structures

✭ 480

python metadata container hash forensics recovery

Turbinia

Automation and Scaling of Digital Forensics Tools

✭ 461

python security cloud dfir forensics security-automation

Awesome Forensics

Awesome Forensics Resources. Almost 300 open source forensics tools, and 600 blog posts about forensics.