libyal / libewf-legacy

Related projects: ⓘ

• msuhanov / winmem_decompress
  Extract compressed memory pages from page-aligned data
  ☆41Updated 5 years ago
• jankais3r / Forensic-Version-Checker
  Script that checks for available updates for the most commonly used Digital Forensics tools
  ☆57Updated 3 years ago
• log2timeline / l2tbinaries
  Binaries for the log2timeline projects and dependencies
  ☆38Updated this week
• EricZimmerman / MFT
  MFT parser
  ☆58Updated 6 months ago
• EricZimmerman / RegistryExplorerBookmarks
  Registry Explorer bookmark definitions
  ☆41Updated last year
• tedsmith / NSRL-Stripper
  A simple utility for stripping out either the SHA-1, MD5 or CRC values alone from the NSRL hash database
  ☆14Updated 2 years ago
• NTFSparse / ntfs_parse
  NTFS parser, plus linking capabilites between MFT LogFile and UsnJrnl
  ☆36Updated 8 years ago
• EricZimmerman / VSCMount
  Mount VSCs with ease!
  ☆14Updated last year
• forensenellanebbia / xways-forensics
  Personal settings for X-Ways Forensics
  ☆32Updated 2 years ago
• woanware / JumpLister
  ☆18Updated 11 years ago
• blackbagtech / sleuthkit-APFS
  A fork of The Sleuthkit with Pooled Storage and APFS support. See https://www.youtube.com/watch?v=k1XPillJ7aw for more info and usage.
  ☆26Updated 4 years ago
• forensicmatt / PyWindowsThingies
  Windows Thingies in Python for live use.
  ☆24Updated 5 years ago
• EricZimmerman / RegistryPlugins
  ☆59Updated 2 months ago
• 4n6ist / bulk_extractor-rec
  It is based on bulk_extractor (https://github.com/simsong/bulk_extractor) and add scanners for record carving
  ☆36Updated 4 years ago
• ignacioj / mftf
  $MFT parser (from live systems or a copy of the $MFT) and raw file copy utility
  ☆36Updated 2 months ago
• dfirfpi / decwindbx
  A sort of a toolkit to decrypt Dropbox Windows DBX files
  ☆30Updated 7 years ago
• nannib / Imm2Virtual
  This is a GUI (for Windows 64 bit) for a procedure to virtualize your EWF(E01), DD (raw), AFF disk image file without converting it, dire…
  ☆50Updated 4 years ago
• Silv3rHorn / ArtifactExtractor
  Extract common Windows artifacts from source images and VSCs
  ☆65Updated 3 years ago
• abrignoni / Android-Usagestats-XML-Protobuf
  Android Usagestats XML + Protobuf Parser
  ☆19Updated 3 years ago
• pcbje / pyad1
  Python library for parsing AccessData AD1 images
  ☆29Updated last year
• msuhanov / regf-samples
  Windows registry samples
  ☆23Updated 5 years ago
• appliedsec / forensicscanner
  Forensic Scanner
  ☆40Updated 11 years ago
• sumeshi / ntfsfind
  An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.
  ☆19Updated 6 months ago
• cyb3rfox / MFTEntryCarver
  Carve files for MFT entries (eg. blkls output or memory dumps). Recovers filenames (long & short), timestamps ($STD & $FN) and data if re…
  ☆21Updated 5 years ago
• CarlosLannister / awesome-autopsy-plugins
  A list of Autopsy awesome plugins.
  ☆64Updated 2 years ago
• woanware / lookuper
  Looks stuff up (MD5, SHA256, IP, Domains, URL's, strings e.g. mutexes)...
  ☆36Updated 7 years ago
• MatthewClarkMay / fTriage
  Automating forensic data extraction, reduction, and overall triage of cold disk and memory images.
  ☆21Updated 5 years ago
• jschicht / Secure2Csv
  Decode security descriptors in $Secure on NTFS
  ☆20Updated 2 years ago
• aff4 / Standard
  AFF4 Standard Documents
  ☆25Updated 2 years ago
• GDATAAdvancedAnalytics / winreg-tasks
  ☆13Updated 2 years ago