Th3Tul1p3

RLEAPP

Returns Logs Events And Properties Parser

capa

The FLARE team's open-source tool to identify capabilities in executable files.

WinPmem

The multi-platform memory acquisition tool.

ForensicPosters

awesome-forensics

A curated list of awesome forensic analysis tools and resources

MemProcFS-Analyzer

MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR

cargo-xbuild

Automatically cross-compiles the sysroot crates core, compiler_builtins, and alloc.

BlueHound

BlueHound - pinpoint the security issues that actually matter

timesketch

Collaborative forensic timeline analysis

python-ntfs

Open source Python library for NTFS analysis

tscopy

EventTranscriptParser

Python based tool to extract forensic info from EventTranscript.db (Windows Diagnostic Data)

EventTranscript.db-Research

A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.

Google-Analytic-Parser

Parses for Google Analytic values in raw files like RAM, DD images etc.

mft-parse

Tool to parse the output of MFTDump.exe to bodyfile format

Chrome-Parse

Parse Chrome History and Downloads into TSV or TLN format

Office-Plist-Parser

Script to parse the recent documents from MS Office plist file

Safari-Binary-Cookie-Parser

Script to parse Safari Binary Cookies from Cookies.binarycookies file

OnionPeeler

Python script to batch query the Tor Relays and Bridges

ntfs

An implementation of the NTFS filesystem in a Rust crate, usable from firmware level up to user-mode.

AmcacheParser

Parses amcache.hve files, but with a twist!

RawCopy

Commandline low level file extractor for NTFS

RegistryExplorerBookmarks

Registry Explorer bookmark definitions

PowerForensics

PowerForensics provides an all in one platform for live disk forensic analysis

NMapify

NMapify is a Python tool that creates mind maps to visualize network layouts using Nmap. It also generates test cases for each identified port to assist pentesters in conducting efficient network pentests.

rust-course

hindsight

Web browser forensics for Google Chrome/Chromium

Azure-AD-Incident-Response-PowerShell-Module

The Azure Active Directory Incident Response PowerShell module provides a number of tools, developed by the Azure Active Directory Product Group in conjunction with the Microsoft Detection and Response Team (DART), to assist in compromise response.

CyLR

CyLR - Live Response Collection Tool

thumbsviewer

Thumbs Viewer - Extract Windows Thumbs.db database files.