Alternatives and similar repositories for dfirwizard

Users that are interested in dfirwizard are comparing it to the libraries listed below

• forensicmatt / RustyLnk

  View on GitHub
  LNK to JSON
  ☆14Mar 7, 2019Updated 6 years ago
• n3l5 / irFARTpull

  View on GitHub
  PowerShell script utilized to pull several forensic artifacts from a live Win7 and WinXP system without WINRM.
  ☆51Jan 25, 2018Updated 8 years ago
• forensicmatt / RustyReg

  View on GitHub
  Registry to JSON. This Project is for learning purposes and is not maintained.
  ☆12Dec 28, 2021Updated 4 years ago
• MatthewClarkMay / fTriage

  View on GitHub
  Automating forensic data extraction, reduction, and overall triage of cold disk and memory images.
  ☆21Mar 12, 2019Updated 6 years ago
• CdtDelta / YOP

  View on GitHub
  My Year of Python Repository
  ☆28Jun 13, 2020Updated 5 years ago
• hiddenillusion / IR

  View on GitHub
  Some dfir stuff
  ☆31Jan 12, 2022Updated 4 years ago
• msuhanov / yarp

  View on GitHub
  Yet another registry parser
  ☆138Apr 15, 2022Updated 3 years ago
• forensicmatt / PyWindowsThingies

  View on GitHub
  Windows Thingies in Python for live use.
  ☆24Apr 22, 2019Updated 6 years ago
• bromiley / tools

  View on GitHub
  Various tools and scripts
  ☆43Nov 30, 2022Updated 3 years ago
• zerber0s / mac_int

  View on GitHub
  macOS Artifact Intelligence Tool
  ☆13Apr 30, 2019Updated 6 years ago
• keydet89 / Tools

  View on GitHub
  Tools from WFA 4/e, timeline tools, etc.
  ☆145Feb 29, 2024Updated last year
• iSIGHTPartners / macaroni_extension

  View on GitHub
  A browser extension that seamlessly integrates your yara match notifications into VirusTotal Intelligence.
  ☆17Feb 8, 2015Updated 11 years ago
• PoorBillionaire / USN-Record-Carver

  View on GitHub
  Carve NTFS USN records from binary data
  ☆27May 21, 2017Updated 8 years ago
• randomaccess3 / 4n6_stuff

  View on GitHub
  Git for me to put all my forensics stuff
  ☆23Sep 2, 2025Updated 5 months ago
• jipegit / IRNotes

  View on GitHub
  Some IR notes
  ☆73Jul 23, 2016Updated 9 years ago
• log2timeline / l2tbinaries

  View on GitHub
  Binaries for the log2timeline projects and dependencies
  ☆40Updated this week
• log2timeline / dfvfs

  View on GitHub
  Digital Forensics Virtual File System (dfVFS)
  ☆217Updated this week
• dwmetz / Axiom-PowerShell

  View on GitHub
  PowerShell scripts to aid investigators when utilizing O365 and Magnet Axiom.
  ☆12Aug 26, 2024Updated last year
• elastic / sans-dfir-2022

  View on GitHub
  Repo with supporting material for the talk titled "Cracking the Beacon: Automating the extraction of implant configurations"
  ☆11Feb 6, 2025Updated last year
• paulpc / quickIR

  View on GitHub
  Auxiliary scripts for Incident Response with ELK
  ☆11Oct 7, 2015Updated 10 years ago
• brimorlabs / KStrike

  View on GitHub
  Stand-alone parser for User Access Logging from Server 2012 and newer systems
  ☆78Jan 9, 2024Updated 2 years ago
• msuhanov / dfir_ntfs

  View on GitHub
  An NTFS/FAT parser for digital forensics & incident response
  ☆217Oct 31, 2025Updated 3 months ago
• py4n6 / pytsk

  View on GitHub
  Python bindings for The Sleuth Kit (libtsk)
  ☆111Nov 21, 2025Updated 2 months ago
• PoorBillionaire / Windows-Prefetch-Parser

  View on GitHub
  Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files
  ☆122May 29, 2024Updated last year
• ExabeamLabs / Synopsis

  View on GitHub
  Synopsis is a tool to aid analysts reviewing browser history files by providing a high-level “synopsis” of key information.
  ☆22Oct 31, 2018Updated 7 years ago
• rowingdude / analyzeMFT

  View on GitHub
  analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multip…
  ☆520Aug 13, 2025Updated 6 months ago
• orlikoski / CDQR

  View on GitHub
  The Cold Disk Quick Response (CDQR) tool is a fast and easy to use forensic artifact parsing tool that works on disk images, mounted driv…
  ☆345Jun 25, 2022Updated 3 years ago
• AbdulRhmanAlfaifi / SDSParser-rs

  View on GitHub
  NTFS Security Descriptor Stream ($Secure:$SDS) parser
  ☆14Jan 9, 2023Updated 3 years ago
• adricnet / dfirnotes

  View on GitHub
  DFIR notebooks GCIH Gold project, paper
  ☆12Apr 30, 2015Updated 10 years ago
• tedsmith / NSRL-Stripper

  View on GitHub
  A simple utility for stripping out either the SHA-1, MD5 or CRC values alone from the NSRL hash database
  ☆14Nov 19, 2021Updated 4 years ago
• abrignoni / DFIR-SQL-Query-Repo

  View on GitHub
  Collection of SQL query templates for digital forensics use by platform and application.
  ☆112Apr 17, 2021Updated 4 years ago
• EricZimmerman / iisGeolocate

  View on GitHub
  geolocate ip addresses in IIS logs
  ☆20Jan 8, 2025Updated last year
• cheeky4n6monkey / 4n6-scripts

  View on GitHub
  Forensic Scripts
  ☆154Mar 28, 2025Updated 10 months ago
• forensicmatt / RustyUsn

  View on GitHub
  USN to JSON
  ☆22Apr 4, 2020Updated 5 years ago
• JamesHabben / evolve

  View on GitHub
  Web interface for the Volatility Memory Forensics Framework
  ☆260Nov 21, 2017Updated 8 years ago
• n3l5 / irCRpull

  View on GitHub
  irCRpull is a PowerShell script utilized to pull several system artifacts, utilizing the free tool CrowdResponse, from a live Win7+ syste…
  ☆14Mar 25, 2015Updated 10 years ago
• RealityNet / hotoloti

  View on GitHub
  documentation, scripts, tools related to Zena Forensics (http://blog.digital-forensics.it)
  ☆100Apr 21, 2017Updated 8 years ago
• nrvana / macOS-triage

  View on GitHub
  macOS triage is a python script to collect various macOS logs, artifacts, and other data.
  ☆25Mar 25, 2021Updated 4 years ago
• eopdyke / USB-Device-History

  View on GitHub
  Discover USB device history for a specific user
  ☆23Dec 28, 2015Updated 10 years ago