williballenthin / python-ntfs
Open source Python library for NTFS analysis
☆80Updated 6 years ago
Related projects ⓘ
Alternatives and complementary repositories for python-ntfs
- Extract common Windows artifacts from source images and VSCs☆65Updated 3 years ago
- Example programs used in the automating DFIR series☆64Updated 5 years ago
- Static analysis tools for Microsoft Office Open XML files and documents☆68Updated 7 years ago
- Yet another registry parser☆130Updated 2 years ago
- Volatility plugins created by the author☆44Updated 9 years ago
- Binaries for the log2timeline projects and dependencies☆38Updated 2 months ago
- openioc_scan Volatility Framework plugin☆42Updated 8 years ago
- Python IOC Editor☆61Updated 9 years ago
- Windows registry samples☆23Updated 6 years ago
- Python script for extracting USB information from Windows registry hives☆126Updated 5 years ago
- A Rekall interactive document for a Memory Analysis workshop/course.☆43Updated 7 years ago
- Some dfir stuff☆31Updated 2 years ago
- Extract compressed memory pages from page-aligned data☆41Updated 6 years ago
- threadmap plugin for Volatility Foundation☆27Updated 3 years ago
- ☆82Updated 8 years ago
- Log Examination Tool☆26Updated 8 years ago
- A Windows Event Processing Utility☆46Updated 6 years ago
- Tool suite for inspecting NTFS artifacts.☆216Updated last year
- Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files☆115Updated 5 months ago
- Automating forensic data extraction, reduction, and overall triage of cold disk and memory images.☆21Updated 5 years ago
- NTFS parser, plus linking capabilites between MFT LogFile and UsnJrnl☆36Updated 8 years ago
- Evidence Fetcher (efetch) is a web-based file explorer, viewer, and analyzer.☆37Updated 4 years ago
- An NTFS journal parser☆82Updated 8 years ago
- A modern Python-3-based alternative to RegRipper☆187Updated 2 weeks ago
- Python library for parsing AccessData AD1 images☆29Updated last year
- Windows Thingies in Python for live use.☆24Updated 5 years ago
- A DFVFS Backed Forensic Viewer☆39Updated 4 years ago
- ircollect☆31Updated 11 years ago