Digital Forensics

Volatility 3

Python

Featured

Advanced memory forensics framework. Extracts artifacts from RAM dumps - processes, network connections, registry.

Autopsy

Java

Digital forensics platform with GUI. Disk image analysis, timeline analysis, keyword search, hash filtering.

Ghidra

Java

Featured

NSA's reverse engineering framework. Disassembly, decompilation, graphing, and scripting for binary analysis.

Binwalk

Python

Firmware analysis tool. Searches binary images for embedded files, executables, and file systems.

YARA

C

Featured

Pattern matching swiss knife for malware researchers. Create rules to identify and classify malware samples.

Velociraptor

Go

Featured

Endpoint visibility and collection tool. Hunt for artifacts across thousands of endpoints simultaneously.

Plaso (log2timeline)

Python

Super timeline creation engine. Extracts timestamps from multiple forensic artifact sources into a single timeline.

Radare2

C

Portable reversing framework. Disassembly, debugging, analysis, patching, and scripting in a single CLI.

Cutter

C++

GUI for Radare2. Makes reverse engineering accessible with graphs, decompiler, and hex editor built in.

The Sleuth Kit

C

Collection of command-line tools for forensic analysis of disk images and file systems.

CyLR

C#

Live response collection tool for quickly gathering forensic artifacts from hosts during incident response.

Chainsaw

Rust

Rapidly search and hunt through Windows forensic artifacts like event logs, MFT, and Shimcache using Sigma rules.

Hayabusa

Rust

Windows event log fast forensics timeline generator and threat hunting tool with built-in Sigma rule support.

oletools

Python

Python tools for analyzing OLE and MS Office files - detect VBA macros, embedded objects, and malicious content.

PE-sieve

C++

Scans running processes for suspicious in-memory modifications including hollowing, hooking, and code injection.

capa

Python

Automatically identify capabilities in executable files - detects techniques like persistence, C2, and anti-analysis.

RegRipper

Perl

Windows registry forensic parser. Extracts and decodes forensic artifacts from registry hives with extensible plugins.

bulk_extractor

C++

High-performance forensic data carver. Extracts email addresses, URLs, credit cards, and other artifacts from disk images at speed.

Timesketch

Python

Google's collaborative forensic timeline analysis platform for organizing and annotating investigation events.

Depix

Python

Recover plaintext from pixelized screenshots using De Bruijn sequence matching.

usbrip

Python

Track USB device connection history and generate forensic artifacts on Linux.

Fibratus

Go

Windows kernel event tracing and threat detection tool. Captures process, file, registry, network, and driver events in real-time.

Cowrie

Python

Medium-interaction SSH and Telnet honeypot. Logs brute force attacks, shell interactions, and malware downloads.