ydkhatri

mac_apt

macOS (& ios) Artifact Parsing Tool

MacForensics

Scripts to process macOS forensic artifacts

OneDrive

OneDrive log .ODL reader

spotlight_parser

Read and extract data from macOS spotlight databases

UnifiedLogReader

A parser for Unified logging tracev3 files

blackboxprotobuf

Blackbox protobuf is a library for decoding and modifying arbitrary protobuf messages without the protobuf type definition.

APFS_010

010 template for apfs

nska_deserialize

NSKeyedArchive plist deserializer

macOS_FE

Tools for macOS Forensic Bootable media

jarp

Just Another broken Registry Parser (JARP)

Appx-Analysis

Scripts and tools created for appx analysis talk (Magnet summit 2019)

Presentations

Slides and material from my conference presentations

pyliblzfse

Python bindings for LZFSE

spotlight_queries

Queries for parsed spotlight database in sqlite

Android

Android forensics related scripts

Bash_Basics

ALEAPP

Android Logs Events And Protobuf Parser

Android-Usagestats-XML-Parser

Android Usagestats XML Parser

macosac

Forensic Artifact Collection Tool for macOS

pyaff4

The Python implementation of the AFF4 standard.

bmc-tools

RDP Bitmap Cache parser

dissect.esedb

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.

go-ntfs

An NTFS file parser in Go

iLEAPP

iOS Logs, Events, And Plists Parser

KapeFiles

This repository serves as a place for community created Targets and Modules for use with KAPE.

pylzfse

For the latest go to https://github.com/ydkhatri/pyliblzfse. This project is old and unused now.

srum-dump

A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.

test_garbage

tex2img

a texture decompression C++-extension for Python

velociraptor-docs

Documentation site for Velociraptor