cyb3rfox / MFTEntryCarver
Carve files for MFT entries (eg. blkls output or memory dumps). Recovers filenames (long & short), timestamps ($STD & $FN) and data if resident. It will also parse half broken entries as long as at least one $FN entry is ok.
☆21Updated 5 years ago
Related projects ⓘ
Alternatives and complementary repositories for MFTEntryCarver
- Steezy - Ghetto Yara Generation☆15Updated last year
- NTFS parser, plus linking capabilites between MFT LogFile and UsnJrnl☆36Updated 8 years ago
- Handy scripts to speed up malware analysis☆35Updated last year
- Windows registry samples☆23Updated 6 years ago
- Force-Directed Graph Generator for Volatility Ouputs☆26Updated 5 years ago
- Extract compressed memory pages from page-aligned data☆41Updated 6 years ago
- Plugins for the Viper Framework☆14Updated 5 years ago
- Generate YARA rules for OOXML documents.☆37Updated last year
- Generates YARA rules to detect malware using API hashing☆17Updated 3 years ago
- RegRipper wrapper for simplified bulk parsing or registry hives☆9Updated 6 years ago
- Links to malware-related YARA rules☆14Updated 2 years ago
- Generate a Yara rule to find base64-encoded files containg a specific keyword☆40Updated 6 years ago
- A Windows REG file to enable all default PowerShell logging on a system with PowerShell v5 installed☆16Updated 8 years ago
- Parses the WMI object database....looking for persistence☆31Updated 4 years ago
- Python emulator for Excel XLM macros.☆18Updated 4 years ago
- ☆12Updated 3 years ago
- This repository regroups the Yara Rules for the Unprotect Project☆25Updated 4 years ago
- Set of utilities for getting information about Windows Events☆15Updated 6 years ago
- Psinfo is a Volatility plugin which collects the process related information from the VAD (Virtual Address Descriptor) and PEB (Process E…☆36Updated 8 years ago
- A collection of my public YARA signatures for various malware families☆29Updated 2 months ago
- Scans through registry hives outputting entropy values for key/values, dumps binary contents to files...we are looking for those "fileles…☆11Updated 5 years ago
- A collection of Volatility Framework plugins.☆26Updated 11 years ago
- A collection of threat intelligence data such as IOC, Yara and Snort/Suricata Rules etc.☆10Updated 5 years ago
- TA505 unpacker Python 2.7☆46Updated 4 years ago
- Parsing MITRE EDR Evaluation results☆12Updated 5 years ago
- Tool to decompress data from Windows 10 page files and memory dumps, that has been compressed by the Windows 10 memory manager.☆48Updated 5 years ago
- Presentation materials for talks I've given.☆20Updated 5 years ago
- My collection of scripts for Ghidra (https://github.com/NationalSecurityAgency/ghidra)☆10Updated 4 years ago