thimbleweed / All-In-USB
☆145Updated 10 years ago
Alternatives and similar repositories for All-In-USB:
Users that are interested in All-In-USB are comparing it to the libraries listed below
- Parses amcache.hve files, but with a twist!☆131Updated 2 months ago
- RegRipper3.0☆589Updated 3 months ago
- Collect-MemoryDump - Automated Creation of Windows Memory Snapshots for DFIR☆237Updated last week
- MAL-CL (Malicious Command-Line)☆310Updated 2 years ago
- An easy to use PowerShell script to collect memory and disk forensics for DFIR investigations.☆280Updated 7 months ago
- Parses $MFT from NTFS file systems☆235Updated 3 weeks ago
- RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps.☆255Updated last year
- Digital forensic acquisition tool for Windows based incident response.☆338Updated 11 months ago
- Incident Response collection and processing scripts with automated reporting scripts☆295Updated 9 months ago
- Chocolatey packages supporting the analysis environment projects FLARE-VM & Commando VM.☆174Updated last week
- C# based evtx parser with lots of extras☆298Updated last week
- Live forensic artifacts collector☆165Updated 9 months ago
- MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR☆614Updated last month
- PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs…☆178Updated 11 months ago
- Blue Team detection lab created with Terraform and Ansible in Azure.☆153Updated 4 months ago
- Prefetch Explorer Command Line☆250Updated 2 months ago
- Lnk Explorer Command line edition!!☆296Updated 3 months ago
- AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10☆117Updated 2 months ago
- A python script developed to process Windows memory images based on triage type.☆261Updated last year
- evtx-hunter helps to quickly spot interesting security-related activity in Windows Event Viewer (EVTX) files.☆151Updated 3 years ago
- Detect and respond to Cobalt Strike beacons using ETW.☆489Updated 2 years ago
- Checks running processes, process metadata, Dlls loaded into your current process and the each DLLs metadata, common install directories,…☆258Updated last year
- Automagically extract forensic timeline from volatile memory dump☆129Updated 11 months ago
- RDP Bitmap Cache parser☆519Updated 2 months ago
- Initial triage of Windows Event logs☆97Updated 9 months ago
- The multi-platform memory acquisition tool.☆771Updated 4 months ago
- This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole …☆199Updated 4 years ago
- Cobalt Strike Beacon configuration extractor and parser.☆152Updated 3 years ago
- An NTFS/FAT parser for digital forensics & incident response☆200Updated 5 months ago
- The Volatility Collaborative GUI☆242Updated this week