Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

awesome-forensic-analysis-tools


https://github.com/Mehedi-Babu/awesome-forensic-analysis-tools

Last synced: 4 days ago
JSON representation

  • Collections

  • Tools

    • Distributions

    • Frameworks

      • Autopsy - SleuthKit GUI
      • dff - Forensic framework
      • dexter - Dexter is a forensics acquisition framework designed to be extensible and secure
      • hashlookup-forensic-analyser - A tool to analyse files from a forensic acquisition to find known/unknown hashes from [hashlookup](https://www.circl.lu/services/hashlookup/) API or using a local Bloom filter.
      • IntelMQ - IntelMQ collects and processes security feeds
      • Kuiper - Digital Investigation Platform
      • Laika BOSS - Laika is an object scanner and intrusion detection system
      • PowerForensics - PowerForensics is a framework for live disk forensic analysis
      • TAPIR - TAPIR (Trustable Artifacts Parser for Incident Response) is a multi-user, client/server, incident response framework
      • The Sleuth Kit - Tools for low level forensic analysis
      • turbinia - Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
      • IPED - Indexador e Processador de Evidências Digitais - Brazilian Federal Police Tool for Forensic Investigations
      • Wombat Forensics - Forensic GUI tool

    • IOC Scanner

      • Redline - Free endpoint security tool from FireEye
      • THOR Lite - Free IOC and YARA Scanner
      • Fastfinder - Fast customisable cross-platform suspicious file finder. Supports md5/sha1/sha256 hashes, literal/wildcard strings, regular expressions and YARA rules
      • Fenrir - Simple Bash IOC Scanner
      • Loki - Simple IOC and Incident Response Scanner
      • recon - Performance oriented file finder with support for SQL querying, index and analyze file metadata with support for YARA.

    • Acquisition

      • Belkasoft RAM Capturer - Volatile Memory Acquisition Tool
      • CrowdResponse - A static host data collection tool by CrowdStrike
      • DFIR ORC - Forensics artefact collection tool for systems running Microsoft Windows
      • FireEye Memoryze - A free memory forensic software
      • Magnet RAM Capture - A free imaging tool designed to capture the physical memory
      • WinTriage - Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive.
      • artifactcollector - A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
      • ArtifactExtractor - Extract common Windows artifacts from source images and VSCs
      • AVML - A portable volatile memory acquisition tool for Linux
      • FastIR Collector - Collect artifacts on windows
      • LiME - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
      • unix_collector - A live forensic collection script for UNIX-like systems as a single script.
      • Velociraptor - Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries

    • Imaging

      • dc3dd - Improved version of dd
      • dcfldd - Different improved version of dd (this version has some bugs!, another version is on github [adulau/dcfldd](https://github.com/adulau/dcfldd))
      • Guymager - Open source version for disk imageing on linux systems
      • FTK Imager - Free imageing tool for windows

    • Carving

      • photorec - File carving tool
      • bstrings - Improved strings utility
      • bulk_extractor - Extracts information such as email addresses, creditcard numbers and histrograms from disk images
      • floss - Static analysis tool to automatically deobfuscate strings from malware binaries
      • swap_digger - A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.

    • Network Forensics

    • Windows Artifacts

      • FRED - Cross-platform microsoft registry hive editor
      • LastActivityView - LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
      • MFT-Parsers - Comparison of MFT-Parsers
      • MFTEcmd - MFT Parser by Eric Zimmerman
      • Beagle - Transform data sources and logs into graphs
      • Hayabusa - A a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
      • LogonTracer - Investigate malicious Windows logon by visualizing and analyzing Windows event log
      • python-evt - Pure Python parser for classic Windows Event Log files (.evt)
      • RegRipper3.0 - RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis
      • RegRippy - A framework for reading and extracting useful forensics data from Windows registry hives
      • MFTExtractor - MFT-Parser

    • Mobile Forensics

      • ArtEx - Artifact Examiner for iOS Full File System extractions

    • Internet Artifacts

      • ChromeCacheView - A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache

    • Timeline Analysis

      • Timeline Explorer - Timeline Analysis tool for CSV and Excel files. Built for SANS FOR508 students

    • Disk image handling

      • xmount - Convert between different disk image formats

    • Decryption

    • Picture Analysis

      • Ghiro - A fully automated tool designed to run forensics analysis over a massive amount of images

    • Metadata Forensics

    • Live Forensics

      • grr - GRR Rapid Response: remote live forensics for incident response
      • Linux Expl0rer - Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
      • mig - Distributed & real time digital forensics at the speed of the cloud
      • osquery - SQL powered operating system analytics
      • POFR - The Penguin OS Flight Recorder collects, stores and organizes for further analysis process execution, file access and network/socket endpoint data from the Linux Operating System.
      • UAC - UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.

    • Memory Forensics

      • inVtero.net - High speed memory analysis framework
      • KeeFarce - Extract KeePass passwords from memory
      • MemProcFS - An easy and convenient way of accessing physical memory as files a virtual file system.
      • Rekall - Memory Forensic Framework
      • volatility - The memory forensic framework
      • VolUtility - Web App for Volatility framework

  • Learn Forensics

  • Resources

Programming Languages
Python 19 Go 6 Shell 6 C++ 5 Rust 4 C 3 C# 3 Perl 2 JavaScript 2 HTML 1
Categories
Tools 82 Resources 29 Learn Forensics 11 Related Awesome Lists 8 Collections 2
Sub Categories
Twitter 15 Acquisition 13 Frameworks 13 Windows Artifacts 11 CTFs and Challenges 8 Labs 8 Live Forensics 6 IOC Scanner 6 Memory Forensics 6 Carving 5 Distributions 5 Imaging 4 Blogs 4 Books 3 File System Corpora 3 Steganography 3 Network Forensics 3 Web 2 Other 2 Decryption 2 Disk image handling 1 Timeline Analysis 1 Mobile Forensics 1 Metadata Forensics 1 Picture Analysis 1 Internet Artifacts 1
Keywords
dfir 16 security 14 incident-response 10 forensics 10 awesome 6 digital-forensics 6 awesome-list 5 list 4 python 4 cybersecurity 4 linux 4 malware 3 forensic-analysis 3 threat-hunting 3 rust 3 computer-forensics 2 freebsd 2 intrusion-detection 2 live-response 2 openbsd 2 script 2 shell 2 solaris 2 blueteam 2 security-automation 2 threat 2 ioc 2 incident 2 forensics-investigations 2 dfir-automation 2 memory-forensics 2 malware-analysis 2 hacking 2 android 2 windows 2 hashlookup 1 detection 1 event 1 hayabusa 1 bloom-filter 1 timeline-analysis 1 sift 1 sans 1 saltstack 1 salt-state 1 hunting 1 issues-only 1 logs 1 cli 1 cast-distro 1