Tools: forensic (94)

A tool to create aff-images.

A GUI front-end to dd/dc3dd designed for easily creating forensic images.

Parse the MFT file from an NTFS filesystem.

Tool for copying largely sparse files using information from a block map file.

RDP Bitmap Cache parser.

Maltego rapid transform development and execution framework.

Malicious HTTP traffic explorer tool.

The little brother to Maltego without transforms, but combines graph and link analysis to examine links between manually

An information gathering tool and dns / whois / web server scanner

A Cross-Platform Forensic Framework for Google Chrome

An NTFS parser for digital forensics & incident response.

Framework for orchestrating forensic collection, processing and data export.

Tool to work with Windows executables digital signatures.

Disk Editor and Data Recovery Software.

A CLI tool to uncompress Apple's compressed DMG files to the HFS+ IMG format.

A network forensic analysis framework.

Examine the contents of Outlook Express DBX email repository files.

Analyze MIME files.

Fix acquired .evt - Windows Event Log files (Forensics).

Tool to extract the $UsnJrnl from an NTFS volume.

Extract passwords from Mozilla Firefox, Waterfox, Thunderbird, SeaMonkey profiles.

A universal memory dumper using Frida.

Forensic goroutine-to-syscall inspector for live Go processes.

Command line utility and Python package to ease the (un)mounting of forensic disk images.

An advanced parser for INDX records.

Carve INDX records from a chunk of data.

A Tool suite for inspecting NTFS artifacts.

A proof-of-concept tool for identification of cryptographic keys in binary material (regardless of target operating syst

iOS forensic tool.

IOS Backup Analyzer.

Allows you to forensically examine or recover date from in iOS device.

JFFS2 filesystem extraction tool.

An open source application used to retrieve lots of passwords stored on a local computer.

Offline search tool for LDAP directory dumps in LDIF format.

Recover event log entries from an image by heurisitically looking for record structures.

Library and tools to access FileVault Drive Encryption (FVDE) encrypted volumes.

Remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.

Parser for $LogFile on NTFS.

Simple IOC and Incident Response Scanner.

This tool will embed javascript inside a PDF document.

A tool for the automatic analyze of malware behavior.

Submits a file's SHA1 sum to VirusTotal to determine whether it is a known piece of malware

A small, non-interactive utility that scans mail folders for messages matching regular expressions. It does matching aga

Dumps any userspace process memory without affecting its execution.

Extract $MFT record info and log it to a csv file.

Carve $MFT records from a chunk of data (for instance a memory dump).

Command line $MFT record decoder.

Resolve file index number to name or vice versa on NTFS.

A tool to dump the login password from the current linux user.

An open-source forensic framework written in Python/GTK that manages cases and case items, providing an abstract interfa

A tool aimed at analyzing and capturing data that is hidden between frames in an MP3 file or stream, otherwise noted as

Memory Extractor & Analyzer.

Network Appliance Forensic Toolkit.

Network Forensics CLI utility that performs Network Scanning, OSINT, and Attack Detection.

A Network Forensic Analysis Tool for advanced Network Traffic Analysis, sniffer and packet analyzer.

A tool for extracting files from the network in real-time or post-capture from an offline tcpdump pcap savefile.

Active Directory forensic framework.

Extract files off NTFS.

This tool can parse $LogFile, $UsnJrnl of NTFS.

A tool to parse the Windows XML Event Log (EVTX) format.

A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, h

Extract PDB file paths from large sample sets of executable files.

Utility for facebook memory forensics.

A tool aimed at analyzing PDF documents.

A Python tool to explore PDF files in order to find out if the file can be harmful or not.

Command line based tool for PE32/PE32+ file analysis.

Powerful commandline $MFT record editor.

Recordization library.

A Python tool to explore PDF files in order to find out if the file can be harmful or not.

Carve RCRD records ($LogFile) from a chunk of data..

Python parser for the RecentFileCache.bcf on Windows.

A tool for forensic file system reconstruction.

Library for parsing offline registry hives.

Framework for reading and extracting useful forensics data from Windows registry hives.

Memory Forensic Framework.

Forensic tool to replay web-based attacks (and also general HTTP traffic) that were captured in a pcap file.

Decode security descriptors in $Secure on NTFS.

Browse the Shadow Copies created by the Windows Vista / 7 / 8 / 10 Volume Shadow Copy Service.

A Cross Platform Forensic Framework for Skype.

A tool used to automate Linux swap analysis during post-exploitation or forensics.

Reveal encrypted files stored on a filesystem.

IP URL and MD5 OSINT Analysis

Extract Windows thumbcache database files.

An utility designed to identify file types from their binary signatures.

Detect TrueCrypt containers using a fast and memory efficient approach.

USB device artifacts tracker.

Parser for $UsnJrnl on NTFS.

A Python script to parse the NTFS USN journal.

A VBA parser and emulation engine to analyze malicious macros.

Mac OS X Memory Analysis Toolkit.

Volatility plugins developed and maintained by the community.

Parse Windows Prefetch files.

Scripts used to find evidence in WMI repositories.

ZIP dump utility.