Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

awesome-forensics

⭐️ A curated list of awesome forensic analysis tools and resources
https://github.com/Cugu/awesome-forensics

Last synced: 12 days ago
JSON representation

  • Tools

    • Carving

      • photorec - File carving tool
      • floss - Static analysis tool to automatically deobfuscate strings from malware binaries
      • bulk_extractor - Extracts information such as email addresses, creditcard numbers and histrograms from disk images
      • bstrings - Improved strings utility
      • swap_digger - A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.

    • Network Forensics

      • WireShark - A network protocol analyzer
      • Squey - Logs/PCAP visualization software designed to detect anomalies and weak signals in large amounts of data.
      • NetworkMiner - Network Forensic Analysis Tool
      • Kismet - A passive wireless sniffer
      • RustNet - A cross-platform network monitoring terminal UI providing real-time visibility into network connections
      • Squey - Logs/PCAP visualization software designed to detect anomalies and weak signals in large amounts of data.

    • Distributions

    • Imaging

      • FTK Imager - Free imageing tool for windows
      • dcfldd - Different improved version of dd (this version has some bugs!, another version is on github [adulau/dcfldd](https://github.com/adulau/dcfldd))
      • dcfldd - Different improved version of dd (this version has some bugs!, another version is on github [adulau/dcfldd](https://github.com/adulau/dcfldd))
      • Guymager - Open source version for disk imageing on linux systems
      • dc3dd - Improved version of dd
      • 4n6pi - Forensic disk imager, designed to run on a Raspberry Pi, powered by libewf
      • acquirepi - Successor to 4n6pi, scalable forensic disk imager, designed to run on a Raspberry Pi, powered by libewf

    • Acquisition

      • Belkasoft RAM Capturer - Volatile Memory Acquisition Tool
      • CrowdResponse - A static host data collection tool by CrowdStrike
      • DFIR ORC - Forensics artefact collection tool for systems running Microsoft Windows
      • FireEye Memoryze - A free memory forensic software
      • WinTriage - Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive.
      • Magnet RAM Capture / DumpIt - A free imaging tool designed to capture the physical memory
      • Velociraptor - Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
      • AVML - A portable volatile memory acquisition tool for Linux
      • LiME - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
      • FastIR Collector - Collect artifacts on windows
      • artifactcollector - A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
      • ArtifactExtractor - Extract common Windows artifacts from source images and VSCs
      • Acquire - Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
      • FIT - Forensic acquisition of web pages, emails, social media, etc.
      • ForensicMiner - A PowerShell-based DFIR automation tool, for artifact and evidence collection on Windows machines.
      • SPECTR3 - Acquire, triage and investigate remote evidence via portable iSCSI readonly access
      • unix_collector - A live forensic collection script for UNIX-like systems as a single script.
      • UFADE - Extract files from iOS devices on Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and advanced logical backups.
      • ALEX - Extract files from ADB devices on Windows, Linux and MacOS. Mostly a wrapper for adbutils.
      • TriageHasher - A flexible hashing tool designed for triage collections on Windows, Linux and MacOS. Only hash files with a given extension and location.
      • Hashment - Python forensic tool to analyze, dump, and recover deleted files from YAFFS2 partitions.
      • Fuji - MacOS forensic acquisition made simple. It creates full file system copies or targeted collection of Mac computers.

    • IOC Scanner

      • Redline - Free endpoint security tool from FireEye
      • THOR Lite - Free IOC and YARA Scanner
      • Fastfinder - Fast customisable cross-platform suspicious file finder. Supports md5/sha1/sha256 hashes, literal/wildcard strings, regular expressions and YARA rules
      • Loki - Simple IOC and Incident Response Scanner
      • Fenrir - Simple Bash IOC Scanner
      • recon - Performance oriented file finder with support for SQL querying, index and analyze file metadata with support for YARA.

    • Frameworks

      • Autopsy - SleuthKit GUI
      • Dissect - Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
      • Kuiper - Digital Investigation Platform
      • Laika BOSS - Laika is an object scanner and intrusion detection system
      • IntelMQ - IntelMQ collects and processes security feeds
      • The Sleuth Kit - Tools for low level forensic analysis
      • turbinia - Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
      • PowerForensics - PowerForensics is a framework for live disk forensic analysis
      • dff - Forensic framework
      • dexter - Dexter is a forensics acquisition framework designed to be extensible and secure
      • IPED - Indexador e Processador de Evidências Digitais - Brazilian Federal Police Tool for Forensic Investigations
      • hashlookup-forensic-analyser - A tool to analyse files from a forensic acquisition to find known/unknown hashes from [hashlookup](https://www.circl.lu/services/hashlookup/) API or using a local Bloom filter.
      • Wombat Forensics - Forensic GUI tool
      • TAPIR - TAPIR (Trustable Artifacts Parser for Incident Response) is a multi-user, client/server, incident response framework
      • Autopsy - SleuthKit GUI
      • OpenRelik - Forensic platform to store file artifacts and run workflows

    • Windows Artifacts

      • FRED - Cross-platform microsoft registry hive editor
      • LastActivityView - LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
      • MFT-Parsers - Comparison of MFT-Parsers
      • MFTEcmd - MFT Parser by Eric Zimmerman
      • Beagle - Transform data sources and logs into graphs
      • Hayabusa - A a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
      • LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log
      • NTFSTool - Complete NTFS forensics tool
      • RegRippy - A framework for reading and extracting useful forensics data from Windows registry hives
      • python-evt - Pure Python parser for classic Windows Event Log files (.evt)
      • RegRipper3.0 - RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis
      • MFTExtractor - MFT-Parser
      • NTFS USN Journal parser
      • RecuperaBit - Reconstruct and recover NTFS data
      • python-ntfs - NTFS analysis
      • Blauhaunt - A tool collection for filtering and visualizing logon events
      • PyShadow - A library for Windows to read shadow copies, delete shadow copies, create symbolic links to shadow copies, and create shadow copies
      • MFTMactime - MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.
      • MFT-Parsers - Comparison of MFT-Parsers
      • NTFS journal parser

    • Mobile Forensics

      • ArtEx - Artifact Examiner for iOS Full File System extractions
      • MobSF - An automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
      • Andriller - A software utility with a collection of forensic tools for smartphones
      • ALEAPP - An Android Logs Events and Protobuf Parser
      • iOS Frequent Locations Dumper - Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
      • MEAT - Perform different kinds of acquisitions on iOS devices
      • OpenBackupExtractor - An app for extracting data from iPhone and iPad backups.
      • iLEAPP - An iOS Logs, Events, And Plists Parser

    • Internet Artifacts

      • ChromeCacheView - A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
      • unfurl - Extract and visualize data from URLs
      • hindsight - Internet history forensics for Google Chrome/Chromium
      • chrome-url-dumper - Dump all local stored infromation collected by Chrome
      • IE10Analyzer - This tool can parse normal records and recover deleted records in WebCacheV01.dat.
      • WinSearchDBAnalyzer - This tool can parse normal records and recover deleted records in Windows.edb.

    • Timeline Analysis

      • Timeline Explorer - Timeline Analysis tool for CSV and Excel files. Built for SANS FOR508 students
      • timesketch - Collaborative forensic timeline analysis
      • DFTimewolf - Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
      • plaso - Extract timestamps from various files and aggregate them
      • timeliner - A rewrite of mactime, a bodyfile reader

    • Disk image handling

      • xmount - Convert between different disk image formats
      • libewf - Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
      • Disk Arbitrator - A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
      • imagemounter - Command line utility and Python package to ease the (un)mounting of forensic disk images
      • PancakeViewer - Disk image viewer based in dfvfs, similar to the FTK Imager viewer

    • Decryption

    • Picture Analysis

      • Ghiro - A fully automated tool designed to run forensics analysis over a massive amount of images
      • sherloq - An open-source digital photographic image forensic toolset
      • Ghiro - A fully automated tool designed to run forensics analysis over a massive amount of images

    • Metadata Forensics

      • ExifTool
      • FOCA - FOCA is a tool used mainly to find metadata and hidden information in the documents
      • EXIF Editor - browser, privacy first EXIF Viewer/Editor/Analysis tool (Zero Sign Up). Home to the The EXIF Guide, and The EXIF Quiz.

    • Steganography

      • Sonicvisualizer
      • Zsteg - A steganographic coder for WAV files
      • Steghide - is a steganography program that hides data in various kinds of image and audio files
      • Wavsteg - is a steganography program that hides data in various kinds of image and audio files

    • Live Forensics

      • osquery - SQL powered operating system analytics
      • mig - Distributed & real time digital forensics at the speed of the cloud
      • grr - GRR Rapid Response: remote live forensics for incident response
      • Linux Expl0rer - Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
      • UAC - UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
      • POFR - The Penguin OS Flight Recorder collects, stores and organizes for further analysis process execution, file access and network/socket endpoint data from the Linux Operating System.

    • Docker Forensics

    • OS X Forensics

    • Memory Forensics

      • volatility - The memory forensic framework
      • inVtero.net - High speed memory analysis framework
      • Rekall - Memory Forensic Framework
      • MemProcFS - An easy and convenient way of accessing physical memory as files a virtual file system.
      • KeeFarce - Extract KeePass passwords from memory
      • VolUtility - Web App for Volatility framework

    • Management

      • iris - Collaborative Incident Response platform
      • dfirtrack - Digital Forensics and Incident Response Tracking application, track systems
      • Incidents - Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads
      • Catalyst - Catalyst is an open source security automation and ticket system

  • Resources

  • Collections

  • Learn Forensics

Programming Languages
Python 49 C++ 9 Go 8 Shell 7 JavaScript 6 C# 5 Rust 4 C 4 Perl 3 Ruby 2
Categories
Tools 150 Resources 24 Learn Forensics 14 Related Awesome Lists 12 Collections 3
Sub Categories
Acquisition 22 Windows Artifacts 20 Frameworks 16 Labs 13 CTFs and Challenges 11 Mobile Forensics 8 Steganography 7 OS X Forensics 7 Imaging 7 Network Forensics 6 Internet Artifacts 6 IOC Scanner 6 Blogs 6 Memory Forensics 6 Live Forensics 6 Distributions 5 Timeline Analysis 5 Carving 5 Disk image handling 5 Books 5 Web 4 File System Corpora 4 Other 4 Management 4 Metadata Forensics 3 Picture Analysis 3 Docker Forensics 2 Decryption 2
Keywords
dfir 29 forensics 25 security 19 incident-response 16 digital-forensics 11 awesome 9 python 8 awesome-list 8 cybersecurity 6 linux 5 ntfs 4 threat-hunting 4 malware-analysis 4 forensic-analysis 4 list 4 malware 3 blueteam 3 ioc 3 memory-forensics 3 rust 3 windows 3 forensics-tools 3 gui 2 yara-rules 2 timeline 2 dfir-automation 2 forensics-investigations 2 cpp 2 yara 2 graph 2 incident-management 2 investigation 2 solaris 2 ios 2 computer-forensics 2 shell 2 freebsd 2 live-response 2 macos 2 script 2 openbsd 2 incident 2 owasp 2 threat 2 ctf 2 disk 2 automation 2 security-automation 2 dynamic-analysis 2 malware-research 2