39 entries
| Tool | Description | Section | Links | Last Updated |
|---|---|---|---|---|
| AFFLIBv3sshock/AFFLIBv3 | AFF is an open and extensible file format to store disk images and associated metadata. | Disk Images | GitHub★ 94 |
5mo ago |
| AmcacheParserEricZimmerman/AmcacheParser | Parses amcache.hve files, but with a twist. -. | Windows | GitHub★ 161 |
2d ago |
| Andrillerden4uk/andriller | Performs read-only, forensically sound, non-destructive acquisition from Android devices. | Mobile | GitHub★ 1.6k |
4y ago |
| AppCompatCacheParserEricZimmerman/AppCompatCacheParser | AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10. -. | Windows | GitHub★ 130 |
2d ago |
| Auditpoldocs.microsoft.com | Displays information about and performs functions to manipulate audit policies. | Windows | — | |
| Autopsysleuthkit.org | A digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. | Disk Images | — | |
| Beagleyampelo/beagle | Digital forensics tool which transforms security logs and data into graphs. | Tools | GitHub★ 1.4k |
3y ago |
| DFIR SQL Queryabrignoni/DFIR-SQL-Query-Repo | Download/setup script for malware analysis/software reverse engineering. -. | SQL | GitHub★ 120 |
5y ago |
| Disk Drilldisk-drill.com | Recover deleted files for Mac and Windows. | Images/Documents | — | |
| DissectingMalwa.re Labf0wl/MalwareLab_VM-Setup | Download/setup script for malware analysis/software reverse engineering. | Scripts | GitHub★ 262 |
4y ago |
| DMG2IMGLekensteyn/dmg2img | DMG2IMG is a tool which allows converting Apple compressed dmg archives to standard (hfsplus) image disk files. | Disk Images | GitHub★ 272 |
5y ago |
| EvtxECmdEricZimmerman/evtx | C# based evtx parser with lots of extras. -. | Windows | GitHub★ 377 |
2d ago |
| Exfiltoolexiftool.org | Tool for reading, writing and editing meta information. | Images/Documents | — | |
| ExtensionBlocksEricZimmerman/ExtensionBlocks | Extension blocks as found in ShellBags and other places in the Registry. -. | Windows | GitHub★ 26 |
1d ago |
| FOCAElevenPaths/FOCA | Tool to find metadata and hidden information in the documents. | Images/Documents | GitHub★ 3.7k |
3y ago |
| Hindsightobsidianforensics/hindsight | Web browser forensics for Google Chrome/Chromium. | Browser | GitHub★ 1.5k |
1d ago |
| iisGeolocateEricZimmerman/iisGeolocate | geolocate ip addresses in IIS logs. -. | Windows | GitHub★ 21 |
2d ago |
| JLECmdEricZimmerman/JLECmd | Automatic and Custom Destinations jump list parser with Windows 10 support. -. | Windows | GitHub★ 124 |
2d ago |
| KAPE FilesEricZimmerman/KapeFiles | This repository serves as a place for community created Targets and Modules for use with KAPE. -. | Windows | GitHub★ 889 |
6d ago |
| LECmdEricZimmerman/LECmd | Lnk Explorer Command line edition!. | Windows | GitHub★ 349 |
2d ago |
| LnkEricZimmerman/Lnk | Lnk file parser. | Windows | GitHub★ 100 |
2d ago |
| MFTEricZimmerman/MFT | MFT parser. | Windows | GitHub★ 80 |
1d ago |
| MFTECmdEricZimmerman/MFTECmd | Parses $MFT from NTFS file systems. | Windows | GitHub★ 342 |
1d ago |
| OleCFEricZimmerman/OleCf | Library to process OLE compound file format. | Windows | GitHub★ 19 |
9d ago |
| Orbits0md3v/Orbit | Blockchain Transactions Investigation Tool. | Blockchain | GitHub★ 623 |
4y ago |
| PECmdEricZimmerman/PECmd | Prefetch Explorer Command Line. | Windows | GitHub★ 309 |
2d ago |
| PrefetchEricZimmerman/Prefetch | Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10. - -. | Windows | GitHub★ 121 |
9d ago |
| RBCmdEricZimmerman/RBCmd | Recycle bin artifact parser. | Windows | GitHub★ 64 |
2d ago |
| RegistryEricZimmerman/Registry | Full featured, offline Registry parser in C#. | Windows | GitHub★ 260 |
3d ago |
| Registry Explorer BookmarksEricZimmerman/RegistryExplorerBookmarks | Registry Explorer bookmark definitions. -. | Windows | GitHub★ 46 |
3d ago |
| SDBEricZimmerman/SDB | Parse Microsoft shim databases. | Windows | GitHub★ 33 |
3d ago |
| SQLECmdEricZimmerman/SQLECmd | This repo that contains all the Maps used by Eric Zimmerman's SQLECmd. -. | Windows | GitHub★ 61 |
2d ago |
| SrumECmdEricZimmerman/Srum | SRUM parser. | Windows | GitHub★ 56 |
1d ago |
| SumECmdEricZimmerman/Sum | Process Microsoft User Access Log. | Windows | GitHub★ 20 |
1d ago |
| TLEFilePluginsEricZimmerman/TLEFilePlugins | Plugins for parsing CSV files in Timeline Explorer. -. | Windows | GitHub★ 36 |
1d ago |
| USBDevicesEricZimmerman/USBDevices | Get USB Devices from Registry hives. | Windows | Repo not found | |
| VSCMountEricZimmerman/VSCMount | Mount VSCs with ease!. | Windows | GitHub★ 18 |
2d ago |
| WinSearchDBAnalyzerEricZimmerman/WinSearchDBAnalyzer | Parse normal records and recover deleted records in Windows.edb. | Windows | GitHub★ 6 |
5y ago |
| WtTCmdEricZimmerman/WxTCmd | Parser for the Windows 10 Timeline feature database. | Windows | GitHub★ 26 |
2d ago |
Nothing matches that filter. Suggest a tool?