https://github.com/securityronin/issen

Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.

attack-flow browser-forensics dfir digital-forensics disk-forensics duckdb evtx forensics incident-response linux-forensics memory-forensics mitre-attack ntfs rust sigma threat-intelligence timeline velociraptor windows-forensics yara

Last synced: 11 Jul 2026

https://github.com/securityronin/sqlite-forensic

SQLite forensic library — read-only b-tree/freelist/WAL reader plus a deleted-record carver that recovers freed-page, in-page, and dropped-table rows. Panic-free, forbid-unsafe, validated against undark and fqlite.

btree carving data-recovery deleted-record-recovery dfir digital-forensics forensics incident-response rust sqlite sqlite-forensics wal

Last synced: 21 Jun 2026

https://github.com/securityronin/disk-forensic

Forensic disk-image orchestrator — decodes E01/VMDK/VHDX/VHD/QCOW2/DMG containers, auto-detects MBR/GPT/APM, and routes ISO 9660 to filesystem analysis

apm container dfir disk-image dmg e01 ewf forensics gpt iso9660 mbr ntfs optical partition qcow2 rust udif vhd vhdx vmdk

Last synced: 21 Jun 2026

https://github.com/securityronin/vsc-forensic

Volume Shadow Copy forensic library — planned reader/analyzer for Windows VSS store/catalog: enumerate shadow copies, diff filesystem state. Early-stage scaffold.

dfir digital-forensics forensics incident-response rust volume-shadow-copy vss windows

Last synced: 11 Jul 2026

https://github.com/securityronin/veracrypt-forensic

VeraCrypt/TrueCrypt forensic library — brute the header PRF+cipher from a password, recover the master key, and decrypt the volume (AES/Serpent/Twofish, 5 PRFs, hidden volumes). Panic-free, no unsafe.

cryptography dfir digital-forensics encryption forensics incident-response rust truecrypt veracrypt xts

Last synced: 16 Jul 2026

https://github.com/securityronin/ad1-forensic

Pure-Rust reader + forensic auditor for AccessData AD1 logical images (FTK Imager Custom Content Image)

Last synced: 11 Jul 2026

https://github.com/securityronin/leveldb-forensic

Read-only forensic LevelDB reader + Chrome Local/Session Storage decoder (recovers deleted records)

Last synced: 11 Jul 2026

https://github.com/securityronin/forensic-vfs

Read-only forensic VFS contracts — the ImageSource positioned-read byte source, PathSpec locators, and the FileSystem trait; the KNOWLEDGE leaf every fleet reader implements.

dfir digital-forensics disk-image filesystem forensics incident-response rust vfs

Last synced: 11 Jul 2026

https://github.com/securityronin/usb-forensic

USB device-history forensic correlation engine — reconstructs USB connection history from Windows registry/SetupAPI/event-log/LNK artifacts and scores cross-source timestamp consistency. Pipeline-native, reproducible, panic-free.

dfir digital-forensics forensics incident-response registry rust timeline usb usb-forensics windows

Last synced: 11 Jul 2026

https://github.com/securityronin/protobuf-forensic

Schemaless forensic Protocol Buffers decoder — decode protobuf wire format with no .proto, with field-type heuristics + timeglyph timestamp flagging

Last synced: 11 Jul 2026

https://github.com/securityronin/zip-forensic

Pure-Rust forensic ZIP toolkit: zip-full-core reader (no C-FFI, all common codecs + decryption) and zip-forensic anomaly auditor

Last synced: 11 Jul 2026

https://github.com/securityronin/aff4-forensic

Pure-Rust read-only AFF4 disk-image reader (aff4) + forensic integrity analyzer (aff4-forensic)

Last synced: 11 Jul 2026

https://github.com/securityronin/bitlocker-forensic

BitLocker Drive Encryption (BDE) forensic library — parse FVE metadata, unlock via password, decrypt AES-CBC+Elephant-Diffuser volumes, and grade key-protector/clear-key/weak-cipher findings. Panic-free, validated byte-for-byte against libbde.

bitlocker dfir digital-forensics encryption forensics incident-response rust windows

Last synced: 11 Jul 2026

https://github.com/securityronin/apm-partition-forensic

Read-only Apple Partition Map (APM) reader + forensic anomaly auditor — overlaps, out-of-bounds, residual entries, hidden gaps as graded findings. Pure Rust, no unsafe.

apm apple-partition-map dfir digital-forensics disk-image forensics macintosh partition partition-table rust

Last synced: 11 Jul 2026

https://github.com/securityronin/atx-forensic

Reader/decoder for Apple ATX (AAPL) texture-image containers — iOS UI image caches (PosterBoard snapshots, wallpapers, contact posters, Animoji avatars). Decodes ASTC (incl. LZFSE-wrapped) to RGBA.

Last synced: 11 Jul 2026

https://github.com/securityronin/vhd-forensic

Legacy VHD (Virtual PC) disk-image forensic reader — pure-Rust, read-only, no runtime deps.

Last synced: 11 Jul 2026

https://github.com/securityronin/luks-forensic

LUKS forensic library — parse LUKS1/LUKS2 headers, derive the master key, and decrypt the payload. Panic-free, no unsafe, cryptsetup-validated.

cryptography cryptsetup dfir digital-forensics dm-crypt encryption forensics incident-response luks rust

Last synced: 16 Jul 2026

https://github.com/securityronin/dar-forensic

Pure-Rust forensic reader + anomaly auditor for Denis Corbin DAR (Disk ARchiver) archives, incl. Passware Kit Mobile / Cellebrite mobile extractions; formats 1-11, transparent gzip/bzip2/xz/zstd/lz4/lzo, multi-volume, hardened and fuzz-tested. dar-core reader + dar-forensic analyzer.

archive backup compression dar dfir disk-archiver forensics incident-response mobile-forensics parser passware rust

Last synced: 21 Jun 2026

https://github.com/securityronin/snss-forensic

Chromium/Brave/Edge SNSS session-file forensic decoder — panic-free, read-only; validates the SNSS command stream, decodes navigation base::Pickle payloads, replays per-window tab state. No runtime deps.

brave browser-forensics chrome chromium dfir digital-forensics forensics incident-response rust session-restore snss

Last synced: 21 Jun 2026

https://github.com/securityronin/exec-pe-forensic

PE (Windows executable) forensic analyzer — pe-core parses PE32/PE64 headers (sections, imports, entropy); pe-analysis grades MITRE-tagged anomalies (suspicious imports, packing/entropy, process-injection IOCs)

dfir forensics incident-response malware-analysis mitre-attack packer-detection pe portable-executable rust rust-forensics security windows

Last synced: 21 Jun 2026

https://github.com/securityronin/iso9660-forensic

Forensic ISO 9660 reader & tamper analyzer in pure Rust — analyse() surfaces 23 anomaly findings (redundancy, slack, EDC/ECC, concealment) across multi-session, Rock Ridge, Joliet, El Torito & raw CD images

dfir digital-forensics disk-image ecma-119 el-torito file-format forensics incident-response iso iso9660 joliet optical-disc parser rock-ridge rust security udf

Last synced: 21 Jun 2026

https://github.com/securityronin/hfsplus-forensic

Forensic-grade Apple HFS+/HFSX reader — volume header, catalog B-tree directory listing, and data-fork file extraction

Last synced: 21 Jun 2026

https://github.com/securityronin/vmdk-forensic

Pure-Rust VMware VMDK toolkit: vmdk-core reader (imported as vmdk; recovers damaged disks via the redundant grain directory) + vmdk-forensic analyzer (RGD adjudication, dangling-pointer & provenance findings)

container data-recovery dfir disk-image forensic-analysis forensics incident-response rust rust-crate virtual-disk vmdk vmware

Last synced: 21 Jun 2026

https://github.com/securityronin/lnk-forensic

Windows Shell Link (.lnk) forensics — parse target path, volume serial, MAC times, tracker machine ID; detect removable-media and network targets. Pure Rust. (JumpLists in v0.2.)

dfir digital-forensics forensics incident-response lnk rust shell-link windows

Last synced: 21 Jun 2026

https://github.com/securityronin/lzo

GPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies, and #![forbid(unsafe_code)]; validated against liblzo2 and fuzz-hardened against malicious input.

compression decompression forensics lzo lzo1x lzop no-std pure-rust rust safe

Last synced: 21 Jun 2026

https://github.com/securityronin/cfb-forensic

OLE/CFB ([MS-CFB]) forensic analyzer — carves compound files for orphaned (deleted) directory entries, free-sector + slack residue, and structural tamper tells. Panic-free, no unsafe, fuzzed.

carving cfb compound-file dfir digital-forensics forensics incident-response jumplist ole rust

Last synced: 21 Jun 2026

https://github.com/securityronin/lzvn

Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).

apple compression decmpfs dfir forensics lzvn macos no-std rust

Last synced: 21 Jun 2026

https://github.com/securityronin/ntfs-forensic

From-scratch NTFS reader (ntfs-core: MFT, attributes, indexes, data runs, LZNT1, $UsnJrnl:$J change journal over Read+Seek) plus a graded anomaly auditor (ntfs-forensic: timestomping, alternate data streams, deleted records, MFT/LogFile tamper checks) — panic-free, fuzzed, no unsafe

alternate-data-streams anti-forensics change-journal dfir digital-forensics disk-forensics filesystem forensics incident-response mft ntfs rust rust-forensics security timestomping usn-journal

Last synced: 21 Jun 2026

https://github.com/securityronin/segb-forensic

Apple SEGB (Biome) forensic analyzer + reader — decode SEGB v1/v2 records and flag CRC-mismatch, deletion-residue, and timestamp-order anomalies as graded findings. Panic-free, no unsafe.

apple biome dfir digital-forensics forensics incident-response macos parser rust segb

Last synced: 21 Jun 2026

https://github.com/securityronin/winreg-forensic

Windows Registry hive forensics — panic-free reader, artifact decoders, carving & recovery (SecurityRonin fleet)

Last synced: 21 Jun 2026

https://github.com/securityronin/livedisk-forensic

Cross-platform live block-device enumeration (macOS/Linux/Windows) with partition-layout rendering and acquisition-integrity forensics — fleet *-core/*-forensic split

Last synced: 21 Jun 2026

https://github.com/securityronin/qcow2-forensic

Pure-Rust QCOW2 forensics: reader (qcow2-core) + anomaly auditor (qcow2-forensic) — backing files, snapshots, encryption, refcount orphans on the forensicnomicon report model

dfir disk-image forensics incident-response qcow2 qemu rust

Last synced: 21 Jun 2026

https://github.com/securityronin/vhdx-core

Pure-Rust VHDX (Hyper-V) virtual-disk container library — reader (writer planned), published as the vhdx-core crate

container dfir digital-forensics disk-image forensics hyper-v rust vhdx virtual-disk windows

Last synced: 21 Jun 2026

https://github.com/securityronin/journald-forensic

From-scratch systemd journal (.journal) forensic reader — parse entries without journalctl/systemd, carve from unallocated space, and flag tampering (sequence gaps, timestamp regressions, truncation, online-state)

anti-forensics dfir forensics incident-response journald linux log-analysis log-forensics rust rust-forensics security systemd

Last synced: 21 Jun 2026

https://github.com/securityronin/trash-forensic

Read-only Windows Recycle Bin $I index reader + forensic anomaly analyzer (purged content, path-traversal names, missing deletion times) emitting forensicnomicon findings

Last synced: 21 Jun 2026

https://github.com/securityronin/peripheral-forensic

External-device connection forensics — parse setupapi.dev.log into a typed DeviceConnection timeline across USB, FireWire, Thunderbolt, PCIe, eSATA, SD; classify DMA-capable vs storage vs HID threat. Pure Rust.

dfir digital-forensics forensics incident-response peripheral removable-media rust thunderbolt usb

Last synced: 11 Jul 2026

https://github.com/securityronin/state-history-forensic

State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No deps, no I/O.

dfir digital-forensics forensics incident-response rust state-history temporal

Last synced: 21 Jun 2026

https://github.com/securityronin/apfs-forensic

Apple File System (APFS) forensic library — from-scratch pure-Rust reader (apfs-core) + anomaly analyzer (apfs-forensic) for container, volume, snapshot, encryption and sealed-volume structures. Panic-free, no runtime deps. Design + scaffold; implementation in progress.

apfs apple-file-system dfir digital-forensics file-system filesystem-forensics forensics incident-response macos rust

Last synced: 11 Jul 2026

https://github.com/securityronin/dmg-forensic

Apple Disk Image (DMG/UDIF) forensic library — read UDIF + sparse/sparsebundle images, audit koly-trailer integrity as graded findings. Pure Rust, no C deps.

apple dfir digital-forensics disk-image dmg forensics incident-response macos rust sparse-image udif

Last synced: 11 Jul 2026

https://github.com/securityronin/timeglyph

Forensic timestamp decipherment — decode, encode & identify how systems inscribe time (scored, cited, ambiguity-first), plus a cursor-hover overlay

cli datetime dfir digital-forensics epoch filetime forensics ganzhi holidays incident-response lunisolar overlay rust timestamp timezone

Last synced: 11 Jul 2026

https://github.com/securityronin/dpapi-forensic

Forensic DPAPI toolkit — parse + decrypt DPAPI blobs, unwrap Chrome/Edge v10/v20 cookies (dpapi-core); on-disk credential auditor (WIP)

Last synced: 11 Jul 2026