awesome-forensics
Forensic toolkit
A curated collection of tools and resources for forensic analysis and digital forensics
⭐️ A curated list of awesome forensic analysis tools and resources
4k stars
175 watching
630 forks
last commit: almost 2 years agoLinked from 10 awesome lists
computer-forensicsdfirdigital-forensicsforensic-analysisfreeopen-source
Awesome Forensics / Collections | |||
| AboutDFIR – The Definitive Compendium Project | Collection of forensic resources for learning and research. Offers lists of certifications, books, blogs, challenges and more | ||
| ForensicArtifacts.com Artifact Repository | 1,071 | about 2 years ago | Machine-readable knowledge base of forensic artifacts |
Awesome Forensics / Tools | |||
| Forensics tools on Wikipedia | |||
| Eric Zimmerman's Tools | |||
Awesome Forensics / Tools / Distributions | |||
| bitscout | 464 | over 2 years ago | LiveCD/LiveUSB for remote forensic acquisition and analysis |
| Remnux | Distro for reverse-engineering and analyzing malicious software | ||
| SANS Investigative Forensics Toolkit (sift) | 494 | over 2 years ago | Linux distribution for forensic analysis |
| Tsurugi Linux | Linux distribution for forensic analysis | ||
| WinFE | Windows Forensics enviroment | ||
Awesome Forensics / Tools / Frameworks | |||
| Autopsy | SleuthKit GUI | ||
| dexter | 126 | over 7 years ago | Dexter is a forensics acquisition framework designed to be extensible and secure |
| dff | 276 | over 6 years ago | Forensic framework |
| Dissect | 939 | almost 2 years ago | Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group) |
| hashlookup-forensic-analyser | 126 | about 3 years ago | A tool to analyse files from a forensic acquisition to find known/unknown hashes from API or using a local Bloom filter |
| IntelMQ | 985 | almost 2 years ago | IntelMQ collects and processes security feeds |
| Kuiper | 777 | almost 2 years ago | Digital Investigation Platform |
| Laika BOSS | 743 | almost 2 years ago | Laika is an object scanner and intrusion detection system |
| OpenRelik | Forensic platform to store file artifacts and run workflows | ||
| PowerForensics | 1,389 | almost 3 years ago | PowerForensics is a framework for live disk forensic analysis |
| TAPIR | 45 | about 4 years ago | TAPIR (Trustable Artifacts Parser for Incident Response) is a multi-user, client/server, incident response framework |
| The Sleuth Kit | 2,648 | almost 2 years ago | Tools for low level forensic analysis |
| turbinia | 754 | almost 2 years ago | Turbinia is an open-source framework for deploying, managing, and running forensic workloads on cloud platforms |
| IPED - Indexador e Processador de Evidências Digitais | 996 | almost 2 years ago | Brazilian Federal Police Tool for Forensic Investigations |
| Wombat Forensics | 48 | about 2 years ago | Forensic GUI tool |
Awesome Forensics / Tools / Live Forensics | |||
| grr | 4,811 | almost 2 years ago | GRR Rapid Response: remote live forensics for incident response |
| Linux Expl0rer | 407 | over 2 years ago | Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask |
| mig | 1,205 | about 7 years ago | Distributed & real time digital forensics at the speed of the cloud |
| osquery | 22,065 | almost 2 years ago | SQL powered operating system analytics |
| POFR | 38 | about 2 years ago | The Penguin OS Flight Recorder collects, stores and organizes for further analysis process execution, file access and network/socket endpoint data from the Linux Operating System |
| UAC | 824 | almost 2 years ago | UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts |
Awesome Forensics / Tools / IOC Scanner | |||
| Fastfinder | 234 | over 4 years ago | Fast customisable cross-platform suspicious file finder. Supports md5/sha1/sha256 hashes, literal/wildcard strings, regular expressions and YARA rules |
| Fenrir | 702 | over 4 years ago | Simple Bash IOC Scanner |
| Loki | 3,419 | almost 2 years ago | Simple IOC and Incident Response Scanner |
| Redline | Free endpoint security tool from FireEye | ||
| THOR Lite | Free IOC and YARA Scanner | ||
| recon | 32 | almost 4 years ago | Performance oriented file finder with support for SQL querying, index and analyze file metadata with support for YARA |
Awesome Forensics / Tools / Acquisition | |||
| Acquire | 92 | almost 2 years ago | Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container |
| artifactcollector | 271 | almost 2 years ago | A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system |
| ArtifactExtractor | 66 | over 5 years ago | Extract common Windows artifacts from source images and VSCs |
| AVML | 883 | almost 2 years ago | A portable volatile memory acquisition tool for Linux |
| Belkasoft RAM Capturer | Volatile Memory Acquisition Tool | ||
| DFIR ORC | Forensics artefact collection tool for systems running Microsoft Windows | ||
| FastIR Collector | 507 | over 5 years ago | Collect artifacts on windows |
| FireEye Memoryze | A free memory forensic software | ||
| FIT | 71 | almost 2 years ago | Forensic acquisition of web pages, emails, social media, etc |
| ForensicMiner | 149 | over 2 years ago | A PowerShell-based DFIR automation tool, for artifact and evidence collection on Windows machines |
| LiME | 1,739 | almost 2 years ago | Loadable Kernel Module (LKM), which allows the acquisition of volatile memory from Linux and Linux-based devices, formerly called DMD |
| Magnet RAM Capture / DumpIt | A free imaging tool designed to capture the physical memory | ||
| SPECTR3 | 39 | almost 2 years ago | Acquire, triage and investigate remote evidence via portable iSCSI readonly access |
| UFADE | 175 | almost 2 years ago | Extract files from iOS devices on Linux and MacOS. Mostly a wrapper for pymobiledevice3. Creates iTunes-style backups and advanced logical backups |
| unix_collector | 33 | almost 2 years ago | A live forensic collection script for UNIX-like systems as a single script |
| Velociraptor | 3,020 | almost 2 years ago | Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries |
| WinTriage | Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive | ||
Awesome Forensics / Tools / Imaging | |||
| dc3dd | Improved version of dd | ||
| dcfldd | Different improved version of dd (this version has some bugs!, another version is on github ) | ||
| FTK Imager | Free imageing tool for windows | ||
| Guymager | Open source version for disk imageing on linux systems | ||
| 4n6pi | 18 | about 2 years ago | Forensic disk imager, designed to run on a Raspberry Pi, powered by libewf |
Awesome Forensics / Tools / Carving | |||
| bstrings | 121 | about 3 years ago | Improved strings utility |
| bulk_extractor | 1,129 | almost 2 years ago | Extracts information such as email addresses, creditcard numbers and histrograms from disk images |
| floss | 3,337 | almost 2 years ago | Static analysis tool to automatically deobfuscate strings from malware binaries |
| photorec | File carving tool | ||
| swap_digger | 515 | over 5 years ago | A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc |
Awesome Forensics / Tools / Memory Forensics | |||
| inVtero.net | 281 | almost 3 years ago | High speed memory analysis framework developed in .NET supports all Windows x64, includes code integrity and write support |
| KeeFarce | 1,002 | almost 11 years ago | Extract KeePass passwords from memory |
| MemProcFS | 3,215 | almost 2 years ago | An easy and convenient way of accessing physical memory as files a virtual file system |
| Rekall | 1,931 | almost 6 years ago | Memory Forensic Framework |
| volatility | 7,412 | over 3 years ago | The memory forensic framework |
| VolUtility | 381 | almost 2 years ago | Web App for Volatility framework |
Awesome Forensics / Tools / Network Forensics | |||
| Kismet | 1,631 | almost 2 years ago | A passive wireless sniffer |
| NetworkMiner | Network Forensic Analysis Tool | ||
| Squey | Logs/PCAP visualization software designed to detect anomalies and weak signals in large amounts of data | ||
| WireShark | A network protocol analyzer | ||
Awesome Forensics / Tools / Windows Artifacts | |||
| Beagle | 1,275 | almost 4 years ago | Transform data sources and logs into graphs |
| Blauhaunt | 164 | almost 2 years ago | A tool collection for filtering and visualizing logon events |
| FRED | Cross-platform microsoft registry hive editor | ||
| Hayabusa | 2,353 | almost 2 years ago | A a sigma-based threat hunting and fast forensics timeline generator for Windows event logs |
| LastActivityView | LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer | ||
| LogonTracer | 2,756 | over 2 years ago | Investigate malicious Windows logon by visualizing and analyzing Windows event log |
| PyShadow | 6 | about 2 years ago | A library for Windows to read shadow copies, delete shadow copies, create symbolic links to shadow copies, and create shadow copies |
| python-evt | 49 | about 3 years ago | Pure Python parser for classic Windows Event Log files (.evt) |
| RegRipper3.0 | 562 | almost 2 years ago | RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis |
| RegRippy | 188 | almost 2 years ago | A framework for reading and extracting useful forensics data from Windows registry hives |
| MFT-Parsers | Comparison of MFT-Parsers | ||
| MFTEcmd | MFT Parser by Eric Zimmerman | ||
| MFTExtractor | 14 | almost 2 years ago | MFT-Parser |
| MFTMactime | 12 | over 3 years ago | MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all |
| NTFS journal parser | |||
| NTFS USN Journal parser | 108 | about 4 years ago | |
| RecuperaBit | 549 | over 2 years ago | Reconstruct and recover NTFS data |
| python-ntfs | 81 | almost 9 years ago | NTFS analysis |
Awesome Forensics / Tools / OS X Forensics | |||
| APFS Fuse | 1,814 | about 2 years ago | A read-only FUSE driver for the new Apple File System |
| mac_apt (macOS Artifact Parsing Tool) | 790 | almost 2 years ago | Extracts forensic artifacts from disk images or live machines |
| MacLocationsScraper | 79 | almost 4 years ago | Dump the contents of the location database files on iOS and macOS |
| macMRUParser | 101 | over 8 years ago | Python script to parse the Most Recently Used (MRU) plist files on macOS into a more human friendly format |
| OSXAuditor | 3,128 | about 6 years ago | |
| OSX Collect | 1,879 | over 7 years ago | |
Awesome Forensics / Tools / Mobile Forensics | |||
| Andriller | 1,356 | about 4 years ago | A software utility with a collection of forensic tools for smartphones |
| ALEAPP | 536 | almost 2 years ago | An Android Logs Events and Protobuf Parser |
| ArtEx | Artifact Examiner for iOS Full File System extractions | ||
| iLEAPP | 767 | almost 2 years ago | An iOS Logs, Events, And Plists Parser |
| iOS Frequent Locations Dumper | 82 | almost 8 years ago | Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/ |
| MEAT | 140 | over 6 years ago | Perform different kinds of acquisitions on iOS devices |
| MobSF | 17,691 | almost 2 years ago | An automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis |
| OpenBackupExtractor | 162 | over 4 years ago | An app for extracting data from iPhone and iPad backups |
Awesome Forensics / Tools / Docker Forensics | |||
| dof (Docker Forensics Toolkit) | 95 | over 2 years ago | Extracts and interprets forensic artifacts from disk images of Docker Host systems |
| Docker Explorer | 531 | almost 2 years ago | Extracts and interprets forensic artifacts from disk images of Docker Host systems |
Awesome Forensics / Tools / Internet Artifacts | |||
| ChromeCacheView | A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache | ||
| chrome-url-dumper | 34 | almost 9 years ago | Dump all local stored infromation collected by Chrome |
| hindsight | 1,097 | almost 2 years ago | Internet history forensics for Google Chrome/Chromium |
| IE10Analyzer | 15 | about 2 years ago | This tool can parse normal records and recover deleted records in WebCacheV01.dat |
| unfurl | 619 | almost 2 years ago | Extract and visualize data from URLs |
| WinSearchDBAnalyzer | 121 | about 2 years ago | This tool can parse normal records and recover deleted records in Windows.edb |
Awesome Forensics / Tools / Timeline Analysis | |||
| DFTimewolf | 299 | almost 2 years ago | Framework for orchestrating forensic collection, processing and data export using GRR and Rekall |
| plaso | 1,745 | almost 2 years ago | Extract timestamps from various files and aggregate them |
| Timeline Explorer | Timeline Analysis tool for CSV and Excel files. Built for SANS FOR508 students | ||
| timeliner | 37 | about 2 years ago | A rewrite of mactime, a bodyfile reader |
| timesketch | 2,641 | almost 2 years ago | Collaborative forensic timeline analysis |
Awesome Forensics / Tools / Disk image handling | |||
| Disk Arbitrator | 666 | over 2 years ago | A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device |
| imagemounter | 121 | over 3 years ago | Command line utility and Python package to ease the (un)mounting of forensic disk images |
| libewf | 270 | about 2 years ago | Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01) |
| PancakeViewer | 40 | over 6 years ago | Disk image viewer based in dfvfs, similar to the FTK Imager viewer |
| xmount | Convert between different disk image formats | ||
Awesome Forensics / Tools / Decryption | |||
| hashcat | Fast password cracker with GPU support | ||
| John the Ripper | Password cracker | ||
Awesome Forensics / Tools / Management | |||
| Catalyst | 361 | almost 2 years ago | Catalyst is an open source security automation and ticket system |
| dfirtrack | 482 | about 2 years ago | Digital Forensics and Incident Response Tracking application, track systems |
| Incidents | 65 | over 3 years ago | Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads |
| iris | 1,091 | almost 2 years ago | Collaborative Incident Response platform |
Awesome Forensics / Tools / Picture Analysis | |||
| Ghiro | 486 | about 10 years ago | A fully automated tool designed to run forensics analysis over a massive amount of images |
| sherloq | 2,681 | almost 2 years ago | An open-source digital photographic image forensic toolset |
Awesome Forensics / Tools / Metadata Forensics | |||
| ExifTool | by Phil Harvey | ||
| FOCA | 3,016 | almost 4 years ago | FOCA is a tool used mainly to find metadata and hidden information in the documents |
Awesome Forensics / Tools / Steganography | |||
| Sonicvisualizer | |||
| Steghide | 601 | over 2 years ago | is a steganography program that hides data in various kinds of image and audio files |
| Wavsteg | 14 | almost 9 years ago | is a steganography program that hides data in various kinds of image and audio files |
| Zsteg | 1,333 | over 2 years ago | A steganographic coder for WAV files |
Awesome Forensics / Learn Forensics | |||
| Forensic challenges | Mindmap of forensic challenges | ||
| OpenLearn | Digital forensic course | ||
Awesome Forensics / Learn Forensics / CTFs and Challenges | |||
| BelkaCTF | CTFs by Belkasoft | ||
| CyberDefenders | |||
| DefCon CTFs | archive of DEF CON CTF challenges | ||
| Forensics CTFs | 9,929 | about 2 years ago | |
| MagnetForensics CTF Challenge | |||
| MalwareTech Challenges | |||
| MemLabs | 1,670 | over 5 years ago | |
| NW3C Chanllenges | |||
| Precision Widgets of North Dakota Intrusion | |||
| ReverseEngineering Challenges | |||
Awesome Forensics / Resources / Web | |||
| ForensicsFocus | |||
| Insecstitute Resources | |||
| SANS Digital Forensics | |||
Awesome Forensics / Resources / Blogs | |||
| Netresec | |||
| SANS Forensics Blog | |||
| SecurityAffairs | blog by Pierluigi Paganini | ||
| This Week In 4n6 | Weekly updates for forensics | ||
| Zena Forensics | |||
Awesome Forensics / Resources / Books | |||
| Network Forensics: Tracking Hackers through Cyberspace | Learn to recognize hackers’ tracks and uncover network-based evidence | ||
| The Art of Memory Forensics | Detecting Malware and Threats in Windows, Linux, and Mac Memory | ||
| The Practice of Network Security Monitoring | Understanding Incident Detection and Response | ||
Awesome Forensics / Resources / File System Corpora | |||
| Digital Forensic Challenge Images | Two DFIR challenges with images | ||
| Digital Forensics Tool Testing Images | |||
| The CFReDS Project | |||
Awesome Forensics / Resources / File System Corpora / The CFReDS Project | |||
| Hacking Case (4.5 GB NTFS Image) | |||
Awesome Forensics / Resources / Other | |||
| /r/computerforensics/ | Subreddit for computer forensics | ||
| ForensicPosters | 437 | almost 2 years ago | Posters of file system structures |
| SANS Posters | Free posters provided by SANS | ||
Awesome Forensics / Resources / Labs | |||
| BlueTeam.Lab | 143 | almost 2 years ago | Blue Team detection lab created with Terraform and Ansible in Azure |
Awesome Forensics / Related Awesome Lists | |||
| Android Security | 8,270 | almost 2 years ago | |
| AppSec | 6,372 | about 2 years ago | |
| CTFs | 9,929 | about 2 years ago | |
| Hacking | 13,321 | over 2 years ago | |
| Honeypots | 8,732 | about 2 years ago | |
| Incident-Response | 7,728 | about 2 years ago | |
| Infosec | 5,221 | over 2 years ago | |
| Malware Analysis | 12,073 | over 2 years ago | |
| Pentesting | 22,116 | almost 2 years ago | |
| Security | 12,563 | about 2 years ago | |
| Social Engineering | 2,755 | over 3 years ago | |
| YARA | 3,598 | almost 2 years ago | |
hack-with-github/awesome-hacking
enaqx/awesome-pentest
jivoi/awesome-osint
rshipp/awesome-malware-analysis
meirwah/awesome-incident-response
0x4d31/awesome-threat-detection
inquest/awesome-yara
stuhli/awesome-event-ids
karneades/awesome-malware-persistence
netanmangal/awesome-hackingMore related projects:
a3sal0n/cyberthreathunting
hrishikesh7665/android-pentesting-checklist
clong/detectionlab
giampaolo/psutil
tonyphipps/meerkat
drduh/macos-security-and-privacy-guide
forensicartifacts/artifacts-kb
sleuthkit/autopsy
yamato-security/wela
ufrisk/pcileech
palantir/osquery-configuration
androguard/androguard
mhaggis/sysmon-dfir