Parser for Sdba memory pool tags
☆21Jul 16, 2021Updated 4 years ago
Alternatives and similar repositories for SdbaParser
Users that are interested in SdbaParser are comparing it to the libraries listed below
Sorting:
- Just Another broken Registry Parser (JARP)☆16May 23, 2024Updated last year
- Forensic cheatsheets for use with cheat☆15Dec 2, 2021Updated 4 years ago
- Python web app for previewing data in a Chrome Profile Folder☆23Jul 1, 2024Updated last year
- A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.☆43Jul 18, 2022Updated 3 years ago
- Backstage Parser☆33Jun 23, 2022Updated 3 years ago
- ☆11Aug 3, 2018Updated 7 years ago
- Evtx Log (xml) Browser☆56Mar 12, 2023Updated 2 years ago
- Browse Windows Prefetch versions: 17,23,26,30v1/2,31 & some of SuperFetch .7db/.db's☆64Dec 18, 2024Updated last year
- CryptnetURLCacheParser is a tool to parse CryptAPI cache files☆20Aug 3, 2024Updated last year
- http://moaistory.blogspot.com/2018/10/winsearchdbanalyzer.html☆127Jul 20, 2024Updated last year
- ☆20Jan 10, 2025Updated last year
- Google Filestream Forensic Tool☆22Mar 10, 2022Updated 3 years ago
- Carve file metadata from NTFS index ($I30) attributes☆71Feb 3, 2024Updated 2 years ago
- Quick ESXi Log Parser☆29Oct 20, 2025Updated 4 months ago
- The home of the BriMor Labs rdpieces Perl script that tries to rebuild parsed RDP Bitmap Cache images☆89Aug 29, 2023Updated 2 years ago
- ☆24Mar 12, 2025Updated 11 months ago
- Decode security descriptors in $Secure on NTFS☆22Feb 24, 2022Updated 4 years ago
- Library of threat hunts to get any user started!☆49Sep 4, 2020Updated 5 years ago
- Yet another registry parser☆138Apr 15, 2022Updated 3 years ago
- Windows event log anomaly detection powered by ATPA technologies☆26Dec 22, 2022Updated 3 years ago
- A repo to centralize some of the regular expressions I've found useful over the course of my DFIR career.☆107Nov 23, 2022Updated 3 years ago
- An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.☆28Updated this week
- Extension blocks as found in ShellBags and other places in the Registry☆25Jan 7, 2025Updated last year
- Queries for parsed spotlight database in sqlite☆13Dec 29, 2020Updated 5 years ago
- A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of eve…☆53Oct 29, 2025Updated 3 months ago
- Transform EQL detection rules to VQL artifacts☆12Nov 12, 2021Updated 4 years ago
- The ultimate streamline for Volatility 3. Speed up process of memory artifacts extraction phase☆14Dec 19, 2024Updated last year
- Here are some tools I developed to help analyze malware☆11Nov 8, 2023Updated 2 years ago
- PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.☆12Aug 26, 2024Updated last year
- Convert a variety of log formats to CSV while enriching detected IPs with Geolocation, ASN, DNS, WhoIs, Shodan InternetDB and Threat Indi…☆110Feb 6, 2026Updated 3 weeks ago
- OneDrive log .ODL reader☆158Nov 3, 2024Updated last year
- Search datasets for Bitlocker recovery files and triage live systems for Bitlocker keys.☆51Jan 26, 2025Updated last year
- Multi-quarantine extractor☆52Feb 4, 2026Updated 3 weeks ago
- A Windows Event Log MCP☆40Aug 25, 2025Updated 6 months ago
- Plugins for parsing CSV files in Timeline Explorer. This project allows for anyone to add more supported files (i,e. they get a Line #/ta…☆29May 5, 2025Updated 9 months ago
- An exercise to practice deobfuscating PowerShell Scripts.☆26Feb 10, 2023Updated 3 years ago
- Work in Progress repo☆15Apr 18, 2019Updated 6 years ago
- A library for fast parse & import of Windows Master File Table($MFT) into Elasticsearch.☆12Jun 23, 2025Updated 8 months ago
- ☆11Mar 12, 2021Updated 4 years ago