jeffbryner / NBDServer
Network Block Device Server for windows with a DFIR/forensic focus.
☆97Updated 8 years ago
Alternatives and similar repositories for NBDServer:
Users that are interested in NBDServer are comparing it to the libraries listed below
- An NTFS journal parser☆82Updated 9 years ago
- Digital Forensics Windows Registry (dfWinReg)☆51Updated 4 months ago
- A boot record parser that identifies known good signatures for MBR, VBR and IPL.☆98Updated 2 months ago
- AuditParser☆59Updated 11 years ago
- Recurse through a registry, identifying values with large data -- a registry malware hunter☆45Updated 8 years ago
- Library and tools to access the Volume Shadow Snapshot (VSS) format☆111Updated 8 months ago
- openioc_scan Volatility Framework plugin☆43Updated 9 years ago
- Automated memory forensics analysis☆33Updated 5 years ago
- Checks with NSRL RDS servers looking for for hash matches☆114Updated 4 years ago
- A Powershell script for frequency analysis of separated values data files.☆17Updated 11 years ago
- Cuckoo Sandbox Local Maltego Transforms Project☆49Updated 10 years ago
- Decode security descriptors in $Secure on NTFS☆20Updated 3 years ago
- Unpack MIME attachments from a file and check them against virustotal.com☆44Updated 9 years ago
- Queries to parse sysmon event log file with microsoft logparser☆56Updated 10 years ago
- Python tools for IOC (Indicator of Compromise) handling☆96Updated 3 years ago
- ☆17Updated 7 years ago
- Reconstruct process trees from event logs☆146Updated 4 years ago
- Some dfir stuff☆31Updated 3 years ago
- Public Profile Repository for Rekall Memory Forensic.☆100Updated 4 years ago
- Yara is awesome, but sometimes you need to manipulate the data streams you're scanning in different ways.☆97Updated 10 years ago
- Sysmon configuration☆65Updated 6 years ago
- MantaRay Automated Computer Forensic Triage Tool☆63Updated 6 years ago
- Python unbup script for McAfee .bup files (with some additional fun features). This script is fully implemented in python it's not just a…☆37Updated 7 years ago
- Tools to assist in forensicating docker☆83Updated 2 months ago
- A powershell script for creating a Windows honeyport.☆89Updated last month
- Tool to parse SRU database☆24Updated 7 years ago
- Example programs used in the automating DFIR series☆63Updated 6 years ago
- A Rekall interactive document for a Memory Analysis workshop/course.☆43Updated 8 years ago
- This is a script module for Bro that encapsulates and detects activity related to the Mandiant APT1 report.☆47Updated 11 years ago
- Various scrips☆12Updated 2 years ago