Not The Hidden Wiki
- Autopsy - link
- Foremost - link
- Remote Live Forensics - link
- Volatility 3.0 - link
- Volatility 2.0 - link
- stegoVeritas - link
- Virustotal - link
- Hybrid-Analysis - link
- Any-Run - link
- Hivetools - link
- Eric Zimmerman Forensic Tools - link
- GreyNoise - link
- BruteShark - link
- ThePhish - link
- Search Evasion Techniques - link
- Your Swiss Army knife to analyze malicious web traffic - link
- Extract and Deobfuscate XLM macros - link
- DetectionLab - link
- dftimewolf - link
- timesketch - link
- Andriller - is software utility with a collection of forensic tools for smartphones - link
- angr: a platform-agnostic binary analysis framework - link
- binwalk: Binwalk is a tool for analyzing / reverse engineering / and extracting firmware images. - link
- bruteforce-luks: A tool to help recover encrypted LUKS2 containers - link
- chainsaw: Rapidly Search and Hunt through Windows Forensic Artefacts - link
- exif: Utility to read / write and edit metadata in image / audio and video files - link
- exifprobe: Exifprobe is a command-line tool to parse EXIF data from image files. - link
- exiftool: writing and editing meta information in image / audio and video files. - link
- exiv2: Image metadata library and toolset - link
- ExtractBitlockerKeys: extract the bitlocker recovery keys from a domain. - link
- foremost: Foremost is a forensic tool for recovering files based on their data structures. - link
- sleuthkit: Forensic toolkit to analyze volume and file system data - link
- ID Ransomware - link
- Event log explorer - link
- Returns logs events and protobuf parser - link
- Chrome logs events and protobufs parser - link
- DCode - link
- Sysinfo OST Viewer - link
- Zed is a system that makes data easier by utilizing our new super-structured data model. - link
- PCAP Analysis - link
- Disk recovery software - link
- Android Forensic - link
- MemProcFS-Analyzer - link
- Collect-MemoryDump - link
- Velociraptor - link
- Signal Forensics - link
- oletools - python tools to analyze MS OLE2 files - link
- Powerful Python tool to analyze PDF documents - link
- Loki - Simple IOC and YARA Scanner - link
- evtx2json extracts events of interest from event logs, dedups them, and exports them to json. - link
- Pure Python parser for Windows Event Log files (.evtx) - link
- PowerShell PE Parser - link
- FastIR Collector Linux - link
- OROCHI: The Volatility Collaborative GUI - link
- AutoVolatility: Run several volatility plugins at the same time. - link
- Volatility profiles for Linux and Mac OS X - link
- O-Saft: OWASP SSL advanced forensic tool - link
- PcapXray - link
- swap_digger - link
- Invoke-LiveResponse - link
- mac_apt: macOS Artifact Parsing Tool - link
- MacForensics: Repository of scripts for processing various artifacts from macOS (formerly OSX). - link
- imago-forensics: Imago is a python tool that extract digital evidences from images. - link
- libelfmaster: Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools - link
- turbinia: Automation and Scaling of Digital Forensics Tools - link
- Kuiper: Digital Forensics Investigation Platform - link
- PowerForensics: PowerForensics provides an all in one platform for live disk forensic analysis. link - link
- OfficeForensicTools: A set of tools for collecting forensic information. - link
- CHIRP: A forensic collection tool written in Python. - link
- FastIR Artifacts: Live forensic artifacts collector. - link
- dfir_ntfs: An NTFS/FAT parser for digital forensics & incident response. - link
- MemProcFS: is an easy and convenient way of viewing physical memory as files in a virtual file system. - link
- LeechCore: Physical Memory Acquisition Library & The LeechAgent Remote Memory Acquisition Agent. - link
- PCILeech: Direct Memory Access (DMA) Attack Software. - link
- Static analysis powered security scanner for your terraform code - link
- Awesome Forensics - link
- Autoaudit: A log tampering detection tool - link
- Collection of steganography tools - link
- usermode memory scanner for windows - link
- collection of scripts and utilities to extract and rebuild linux based firmware images. - link
- application to analyze the EML file - link
- online tool for check email Reputation - link
- online tool to analyse pcap files - link
- zsteg - steganographic coder for WAV files - link
- wavsteg - steganography tool for WAV files - link
- sonicvisualiser - audio analysis software - link
- FOCA - metadata extraction tool for documents - link
- sherloq - malware classifier - link
- ghiro - digital image forensics tool - link
- iris-web - web interface for digital forensics - link
- incidents - incident response automation tool - link
- dfirtrack - digital forensics and incident response (DFIR) case management tool - link
- catalyst - incident response and threat intelligence framework - link
- PancakeViewer - Android SQLite database viewer - link
- libewf - library for forensic disk images - link
- imagemounter - tool for mounting forensic disk images - link
- Disk-Arbitrator - tool for managing disk arbitration on macOS - link
- timeliner - timeline generation tool for forensic investigations - link
- introducing-timeline - timeline explorer tool - link
- plaso - super timeline generation tool - link
- WinSearchDBAnalyzer - Windows Search database analysis tool - link
- IE10Analyzer - Internet Explorer 10 history analysis tool - link
- hindsight - forensic analysis tool for browsers - link
- chrome-url-dumper - Chrome URL dumping tool - link
- chrome_cache_view.html - Chrome cache viewer - link
- docker-explorer - Docker container analysis tool - link
- toolkit - Docker forensics toolkit - link
- OpenBackupExtractor - iOS backup extractor - link
- MEAT - Mobile Evidence Acquisition Toolkit (MEAT) - link
- iOS-Frequent-Locations-Dumper - iOS frequent locations dumper - link
- iLEAPP - iOS Logs, Events, and Properties Parser (iLEAPP) - link
- ALEAPP - Advanced iOS Logical Extraction and Analysis (ALEAPP) - link
- osxcollector - OS X forensic evidence collection tool - link
- OSXAuditor - OS X auditor and forensic analysis tool - link
- macMRU-Parser - OS X Most Recently Used (MRU) file parser - link
- Mac-Locations-Scraper - OS X locations scraper tool - link
- mac_apt - macOS artifact parsing toolkit (mac_apt) - link
- apfs-fuse - APFS (Apple File System) FUSE implementation - link
- python-ntfs - Python library for NTFS file system parsing - link
- RecuperaBit - filesystem recovery tool - link
- USN-Journal-Parser - USN (Update Sequence Number) journal parser - link
- ntfs-linker - NTFS junction point creation tool - link
- mftmactime - MFT (Master File Table) MAC (Modification, Access, Change) timeline generator - link
- MFTExtractor - MFT (Master File Table) extractor - link
- regrippy - Registry analysis tool - link
- RegRipper3.0 - Registry analysis tool (RegRipper 3.0) - link
- python-evt - Python library for parsing Windows Event Log files (EVT) - link
- pyshadow - Python library for NTFS shadow copy parsing - link
- LogonTracer - Logon and session timeline analysis tool - link
- computer_activity_view.html - Computer activity viewer - link
- hayabusa - Binary analysis framework - link
- fred - Forensic Registry EDitor (FRED) - link
- Blauhaunt - Anti-forensic tool detector - link
- beagle - A tool for searching and analysing the information found on web servers - link
- squey.org - A tool for parsing and analyzing windows event logs - link
- ?page=Networkminer - A tool for parsing and analyzing windows event logs - link
- kismet - Wireless network and device detector, sniffer, wardriving tool - link
- VolUtility - Web interface for Volatility Memory Forensics - link
- rekall - Memory analysis framework - link
- KeeFarce - Extract KeePass 2.x credentials from memory - link
- inVtero.net - .NET application analysis - link
- PhotoRec - File data recovery tool - link
- bulk_extractor - Forensic tool that scans a disk image, file, or a directory of files and extracts information of interest - link
- bstrings - Binary strings analysis tool - link
- guymager - Forensic imager - link
- dcfldd - Enhanced version of dd for forensics and security - link
- dcfldd.sourceforge.net - Enhanced version of dd for forensics and security - link
- dcfldd.sourceforge.net - Enhanced version of dd for forensics and security - link
- unix_collector - Unix system memory and binary analysis tool - link
- SPECTR3 - DFIR incident response and threat hunting platform - link
- LiME - Linux Memory Extractor - link
- ForensicMiner - Forensic incident response and intelligence gathering - link
- fit - Flexible and Intelligent Tracker - link
- fireeye.market - Artifact repository - link
- Fastir_Collector - Windows forensic memory collection tool - link
- avml - Memory analysis tool - link
- ArtifactExtractor - Forensic artifact extraction tool - link
- artifactcollector - Collects forensic artifacts on live Windows systems - link
- acquire - Evidence acquisition tool - link
- recon - Forensic investigation tool - link
- thor-lite - Host-based intrusion detection system (HIDS) for Windows - link
- uac - Forensic tool for the analysis of User Account Control (UAC) - link
- pofr - PowerForensics PowerShell module - link
- osquery - SQL-powered operating system instrumentation, monitoring, and analytics - link
- mig - MIG - Mozilla Investigation Game - link
- linux-explorer - Linux memory analysis tool - link
- IPED - Internet Picture Evidence Detector (IPED) - link
- tapir - Windows memory forensics tool - link
- laikaboss - File identification tool - link
- intelmq - Incident and event processing framework - link
- hashlookup-forensic-analyser - Hashlookup forensic analyser - link
- dissect - Disk image format converter - link
- dff - Digital Forensics Framework (DFF) - link
- dexter - Automated digital forensics tool - link
- winfe.net - Windows Forensic Environment (WinFE) - link
- sift - SANS Investigative Forensic Toolkit (SIFT) - link
- bitscout - Remote forensics tool - link