bridgeythegeek

editbox

EditBox is a plugin for the Volatility Framework. It extracts the text from Windows Edit controls, that is, textboxes as generated by Windows Common Controls.

ndispktscan

NDISPktScan is a plugin for the Volatility Framework. It parses the Ethernet packets stored by ndis.sys in Windows kernel space memory.

regsize

Parses Windows Registry hive files listing the biggest key values by the size of their associated data.

regentropy

Parses Windows Registry hive files listing the key values with a high entropy.

linux_xwindows

linux_xwindows is a plugin for the Volatility Framework. It extracts various metadata from the window objects registered to X.

mbrmd5

Calculates the MD5 of the first 440 bytes of physical drives and dumps to disk.

batchsigcheck

Automates running sigcheck against a text file of file paths.

grepcidr

Python script to search text for IP addresses within a CIDR.

checkit

Performs various checks on resources and notifies if any fail.

disksanity

Validates the MPT with VBRs

dodnsupdate

A script to update a Digital Ocean DNS record with your current external IPv4 address.

from-zip

Yield file objects from a zip file where the filename matches a condition

get-asn

python library to resolve IP addresses to ASN

hashcheck

Check if a list of hashes exist in another list of hashes

sfi

volatility3

Volatility 3.0 development

XMBRSum

X-Ways extension to calculate the MD5 sum of the first 440 bytes of sector 0 and compare with known goods.

bridgeythegeek.github.io