ydkhatri / macOS_FE
Tools for macOS Forensic Bootable media
☆15Updated 4 years ago
Related projects: ⓘ
- Scripts and tools created for appx analysis talk (Magnet summit 2019)☆13Updated 6 months ago
- Parser fo macOS/iOS FSEvents Logs☆21Updated 4 months ago
- Slides and material from my conference presentations☆13Updated 5 months ago
- Helper scripts to automate the extraction of YARA rules from XProtectRemediators☆18Updated 6 months ago
- NTFS Security Descriptor Stream ($Secure:$SDS) parser☆13Updated last year
- A small tool to easily mount APFS image on macOS for forensics.☆14Updated 4 years ago
- Queries for parsed spotlight database in sqlite☆11Updated 3 years ago
- 010 template for apfs☆23Updated 3 years ago
- This is a repository for reporting any issues in any of my software☆11Updated 6 years ago
- Parser for Sdba memory pool tags☆17Updated 3 years ago
- Some thingy that copies macOS specific forensic artifacts to the location where the script is run from and also generates some folders. B…☆14Updated 2 years ago
- ☆28Updated 3 months ago
- extract and parse WEVT_TEMPLATEs from PE files☆17Updated 8 months ago
- A minimal malware analysis sandbox for macOS☆26Updated last year
- Scans through registry hives outputting entropy values for key/values, dumps binary contents to files...we are looking for those "fileles…☆10Updated 5 years ago
- An efficient tool for extracting files, directories, and alternate data streams directly from NTFS image files.☆17Updated 6 months ago
- Hunt for SQLite files used by various applications☆10Updated 3 weeks ago
- Use "Full Disk Access" permissions to read the contents of TCC.db and display it in human-readable format☆37Updated 3 years ago
- Swift code to programmatically execute local or hosted JXA payloads from Terminal without using the on-disk osascript binary.☆22Updated 3 years ago
- macOS Artifact Intelligence Tool☆13Updated 5 years ago
- A simple utility for stripping out either the SHA-1, MD5 or CRC values alone from the NSRL hash database☆14Updated 2 years ago
- NTFS file system specimens☆13Updated last year
- JXA script for Mythic that prints the TCC.db☆15Updated 3 years ago
- ☆9Updated 5 years ago
- Indicators of Normality☆12Updated 2 years ago
- Just Another broken Registry Parser (JARP)☆15Updated 3 months ago
- Automatic generator of YARA modules based in protocol buffers☆14Updated last week
- Software installation scripts for macOS systems that allows you to setup a Virtual Machine (VM) for reverse engineering macOS malware☆28Updated 3 weeks ago
- ARDvark parses the Apple Remote Desktop (ARD) files to pull out application usage, user activity, and filesystem listings.☆34Updated last year
- Windows 10 Live Information viewer☆33Updated 2 years ago