Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

swap_digger is a tool used to automate Linux swap analysis during post-exploitation or forensics. It automates swap extraction and searches for Linux user credentials, web forms credentials, web forms emails, http basic authentication, Wifi SSID and keys, etc.

Stars: ✭ 354 (-39.9%)

Mutual labels: dfir, forensics

smram parse

System Management RAM analysis tool

Stars: ✭ 50 (-91.51%)

Mutual labels: forensics, dfir

Recuperabit

A tool for forensic file system reconstruction.

Stars: ✭ 280 (-52.46%)

Mutual labels: dfir, forensics

ad-privileged-audit

Provides various Windows Server Active Directory (AD) security-focused reports.

Stars: ✭ 42 (-92.87%)

Mutual labels: forensics, dfir

Diffy

Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

Stars: ✭ 555 (-5.77%)

Mutual labels: dfir, forensics

Chrome Charset

An extension used to modify the page default encoding for Chromium 55+ based browsers.

Stars: ✭ 346 (-41.26%)

Mutual labels: chrome, google-chrome

EventTranscriptParser

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

Stars: ✭ 22 (-96.26%)

Mutual labels: forensics, dfir

Turbinia

Automation and Scaling of Digital Forensics Tools

Stars: ✭ 461 (-21.73%)

Mutual labels: dfir, forensics

PSTrace

Trace ScriptBlock execution for powershell v2

Stars: ✭ 38 (-93.55%)

Mutual labels: forensics, dfir

LevelDBDumper

Dumps all of the Key/Value pairs from a LevelDB database

Stars: ✭ 23 (-96.1%)

Mutual labels: forensics, dfir

DFIR-O365RC

PowerShell module for Office 365 and Azure log collection

Stars: ✭ 158 (-73.17%)

Mutual labels: forensics, dfir

Xdebug Helper For Chrome

Easily activate PHP debugging, profiling and tracing with this Xdebug Chrome extension

Stars: ✭ 270 (-54.16%)

Mutual labels: chrome, google-chrome

uac

UAC is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

Stars: ✭ 260 (-55.86%)

Mutual labels: forensics, dfir

iTunes Backup Reader

Python 3 Script to parse out iTunes backups

Stars: ✭ 108 (-81.66%)

Mutual labels: forensics, dfir

Mac apt

macOS Artifact Parsing Tool

Stars: ✭ 329 (-44.14%)

Mutual labels: dfir, forensics

1click Webpage Screenshot

Entire page Screenshot extension for Google Chrome. I'm developing open source extension for Google Chrome. All extension are free for use. Let's make Chrome great again!

Stars: ✭ 406 (-31.07%)

Mutual labels: chrome, google-chrome

View All Similar Projects ➔

Hindsight

Internet history forensics for Google Chrome/Chromium

Hindsight is a free tool for analyzing web artifacts. It started with the browsing history of the Google Chrome web browser and has expanded to support other Chromium-based applications (with more to come!). Hindsight can parse a number of different types of web artifacts, including URLs, download history, cache records, bookmarks, autofill records, saved passwords, preferences, browser extensions, HTTP cookies, and Local Storage records (HTML5 cookies). Once the data is extracted from each file, it is correlated with data from other history files and placed in a timeline.

It has a simple web UI - to start it, run "hindsight_gui.py" (or on Windows, the packaged "hindsight_gui.exe") and visit http://localhost:8080 in a browser:

The only field you are required to complete is "Profile Path". This is the location of the Chrome profile you want to analyze (the default profile paths for different OSes is listed at the bottom of this page). Click "Run" and you'll be taken to the results page in where you can save the results to a spreadsheet (or other formats).

Manual Installation

pip install pyhindsight
curl -sSL https://raw.githubusercontent.com/obsidianforensics/hindsight/master/install-js.sh | sh

Command Line

There also is command line version of Hindsight - hindsight.py or hindsight.exe. The user guide in the documentation folder covers many topics, but the info below should get you started with the command line version:

Example usage: > C:\hindsight.py -i "C:\Users\Ryan\AppData\Local\Google\Chrome\User Data\Default" -o test_case

Command Line Options:

Option	Description
-i or --input	Path to the Chrome(ium) "Default" directory
-o or --output	Name of the output file (without extension)
-f or --format	Output format (default is XLSX, other options are SQLite and JSONL)
-c or --cache	Path to the cache directory; only needed if the directory is outside the given "input" directory. Mac systems are setup this way by default.
-b or --browser_type	The type of browser the input files belong to. Supported options are Chrome (default) and Brave.
-l or --log	Location Hindsight should log to (will append if exists)
-h or --help	Shows these options and the default Chrome data locations
-t or --timezone	Display timezone for the timestamps in XLSX output

Default Profile Paths

The Chrome default profile folder default locations are:

WinXP: [userdir]\Local Settings\Application Data\Google\Chrome\User Data\Default
Vista/7/8/10: [userdir]\AppData\Local\Google\Chrome\User Data\Default
Linux: [userdir]/.config/google-chrome/Default
OS X: [userdir]/Library/Application Support/Google/Chrome/Default
iOS: \Applications\com.google.chrome.ios\Library\Application Support\Google\Chrome\Default
Android: /userdata/data/com.android.chrome/app_chrome/Default
CrOS: \home\user\<GUID>

Feature Requests

Please visit FeatHub to request new features or vote on existing requests.

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].

Stars: ✭ 589

Visit Git Page 🔗Visit User Page 🔗Visit Issues Page (8) 🔗