Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

ForensicsTools

A list of free and open forensics analysis tools and other resources
https://github.com/mesquidar/ForensicsTools

Last synced: 3 days ago
JSON representation

  • Challenges

    • Acquisition

      • DFIR ORC - Forensics artefact collection tool for systems running Microsoft Windows
      • DumpIt
      • Magnet RAM Capture - is a free imaging tool designed to capture the physical memory
      • RAM Capturer - by Belkasoft is a free tool to dump the data from a computer’s volatile memory. It’s compatible with Windows OS.
      • artifactcollector - A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
      • ArtifactExtractor - Extract common Windows artifacts from source images and VSCs
      • AVML - A portable volatile memory acquisition tool for Linux
      • FastIR Collector - Collect artifacts on windows
      • LiME - Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD
      • Velociraptor - Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
      • Fuji - Graphical interface for the forensic logical acquisition of Mac computers
      • UFADE - Extract files from Apple devices on Windows, Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and "advanced logical backups"
      • FireEye Memoryze

    • Browser Artifacts

      • ChromeCacheView - by Nirsoft is a small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
      • Dumpzilla - extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers
      • chrome-url-dumper - Dump all local stored infromation collected by Chrome
      • hindsight - Internet history forensics for Google Chrome/Chromium
      • unfurl - Extract and visualize data from URLs
      • Dumpzilla - extract all forensic interesting information of Firefox, Iceweasel and Seamonkey browsers
      • mozdmp - Offline profile decryption tool for Mozilla Firefox. Supports multi-core CPU-based cracking of the master password and the latest Firefox hash formats, including those not yet supported by Hashcat and JTR.
      • chrdmp - Decrypt Chrome profile data offline using the Chrome Safe Storage keyring secret.

    • Carving

      • photorec - File carving tool
      • bstrings - Improved strings utility
      • bulk_extractor - Extracts informations like email adresses, creditscard numbers and histrograms of disk images
      • swap_digger - A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.
      • floss - Static analysis tool to automatically deobfuscate strings from malware binaries

    • Decryption

    • Disk image handling

      • OSFMount - allows you to mount local disk image files (bit-for-bit copies of an entire disk or disk partition) in Windows as a physical disk or a logical drive
      • xmount - Convert between different disk image formats
      • Disk Arbitrator - A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
      • imagemounter - Command line utility and Python package to ease the (un)mounting of forensic disk images
      • libewf - Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
      • PancakeViewer - Disk image viewer based in dfvfs, similar to the FTK Imager viewer.

    • Distributions

      • CAINE
      • GRML-Forensic
      • Remnux - Distro for reverse-engineering and analyzing malicious software
      • Santoku Linux - Santoku is dedicated to mobile forensics, analysis, and security, and packaged in an easy to use, Open Source platform.
      • Sumuri Paladin - Linux distribution that simplifies various forensics tasks in a forensically sound manner via the PALADIN Toolbox
      • Tsurugi Linux - Linux distribution for forensic analysis
      • WinFE - Windows Forensics enviroment
      • bitscout - LiveCD/LiveUSB for remote forensic acquisition and analysis
      • SANS Investigative Forensics Toolkit (sift) - Linux distribution for forensic analysis
      • Predator OS - Linux distribution for forensic analysis
      • Predator OS - Linux distribution for forensic analysis

    • Docker Forensics

    • Frameworks

      • Autopsy - SleuthKit GUI
      • dff - Forensic framework
      • dexter - Dexter is a forensics acquisition framework designed to be extensible and secure
      • IntelMQ - IntelMQ collects and processes security feeds
      • Kuiper - Digital Investigation Platform
      • Laika BOSS - Laika is an object scanner and intrusion detection system
      • RegRippy - is a framework for reading and extracting useful forensics data from Windows registry hives.
      • PowerForensics - PowerForensics is a framework for live disk forensic analysis
      • The Sleuth Kit - Tools for low level forensic analysis
      • turbinia - Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms
      • IPED - Indexador e Processador de Evidências Digitais - Brazilian Federal Police Tool for Forensic Investigations
      • Autopsy - SleuthKit GUI

    • Imageing

      • BelkaImager - by Belkasoft allows you to create images of hard and removable disks, Android and iOS devices and download data from the cloud.
      • dc3dd - Improved version of dd
      • Guymager - Open source version for disk imageing on linux systems
      • dcfldd - Different improved version of dd (this version has some bugs!, another version is on github [adulau/dcfldd](https://github.com/adulau/dcfldd))

    • Linux Forensics

    • Live forensics

      • grr - GRR Rapid Response: remote live forensics for incident response
      • Linux Expl0rer - Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
      • mig - Distributed & real time digital forensics at the speed of the cloud
      • osquery - SQL powered operating system analytics

    • Management

      • dfirtrack - Digital Forensics and Incident Response Tracking application, track systems
      • Incidents - Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads
      • dfirtrack - Digital Forensics and Incident Response Tracking application, track systems

    • Memory Forensics

      • inVtero.net - High speed memory analysis framework
      • KeeFarce - Extract KeePass passwords from memory
      • MemProcFS - An easy and convenient way of accessing physical memory as files a virtual file system.
      • Rekall - Memory Forensic Framework
      • volatility - The memory forensic framework
      • VolUtility - Web App for Volatility framework
      • MemPrcFs Analyzer - PowerShell script utilized to simplify the usage of MemProcFS and to optimize your memory analysis workflow.

    • Metadata Forensics

      • ExifTool
      • Exiv2 - Exiv2 is a Cross-platform C++ library and a command line utility to manage image metadata
      • FOCA - FOCA is a tool used mainly to find metadata and hidden information in the documents

    • Mobile Forensics

      • Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices
      • ALEAPP - An Android Logs Events and Protobuf Parser
      • iOS Frequent Locations Dumper - Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
      • MEAT - Perform different kinds of acquisitions on iOS devices
      • MobSF - is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
      • OpenBackupExtractor - is an app for extracting data from iPhone and iPad backups.

    • Network Forensics

    • OS X Forensics

    • Picture Analysis

      • Ghiro - is a fully automated tool designed to run forensics analysis over a massive amount of images
      • sherloq - An open-source digital photographic image forensic toolset

    • Steganography

      • Stegsolve - analyze images in different planes by taking off bits of the image
      • Binwalk - Binwalk is a fast, easy to use tool for analyzing, reverse engineering, and extracting firmware images.
      • Foremost - is a program to recover files based on their headers and footers
      • Steghide - is a steganography program that hides data in various kinds of image and audio files
      • Wavsteg - is a steganography program that hides data in various kinds of image and audio files
      • Zsteg - A steganographic coder for WAV files
      • Stegsolve - analyze images in different planes by taking off bits of the image
      • Steghide - is a steganography program that hides data in various kinds of image and audio files

    • Timeline Analysis

      • DFTimewolf - Framework for orchestrating forensic collection, processing and data export using GRR and Rekall
      • plaso - Extract timestamps from various files and aggregate them
      • timeliner - A rewrite of mactime, a bodyfile reader
      • timesketch - Collaborative forensic timeline analysis

    • Website Forensics

      • Freezing Internet Tool - Python 3 application for forensic acquisition of online content, including web pages, emails, and social media.
      • ScanMalware - Scan websites for malicious behaviours and fingerprint JavaScripts.

    • Windows Artifacts

  • Collections

  • Learn forensics

  • Resources

Programming Languages
Python 41 C++ 9 Go 6 C 5 C# 4 Shell 4 JavaScript 4 Ruby 2 Perl 2 Rust 2
Categories
Challenges 133 Resources 49 Learn forensics 15 Related Awesome Lists 14 Collections 4 Tools 2
Sub Categories
Other 22 Twitter 22 Windows Artifacts 16 Acquisition 13 Frameworks 12 Challenges 12 Distributions 11 OS X Forensics 10 Browser Artifacts 8 Steganography 8 Blogs 8 Memory Forensics 7 Mobile Forensics 6 Disk image handling 6 Carving 5 Books 5 Website Forensics 5 Live forensics 4 Imageing 4 Timeline Analysis 4 File System Corpora 3 Metadata Forensics 3 Webs 3 Management 3 Network Forensics 3 Docker Forensics 2 Picture Analysis 2 Decryption 2 Linux Forensics 1
Keywords
dfir 21 forensics 19 security 14 incident-response 10 digital-forensics 10 awesome 9 awesome-list 8 python 5 memory-forensics 4 list 4 malware-analysis 3 cybersecurity 3 ntfs 3 forensic 2 hacking 2 android 2 ios 2 incident-response-tooling 2 malware 2 timeline 2 threat-hunting 2 disk 2 windows 2 ioc 2 linux 2 ctf 2 owasp 2 dynamic-analysis 2 incident-management 2 malware-research 2 forensic-analysis 2 parser 2 static-analysis 2 lab 1 infosec 1 courses 1 yara-signatures 1 yara-scanner 1 yara-rules 1 yara-manager 1 yara 1 reverse-engineering 1 malware-rules 1 secure-hash 1 runtime-security 1 malware-detection 1 web-security 1 virtual-machine 1 awesome-yara 1 artifacts 1