ModTracer Finds Hidden Linux Kernel Rootkits and then make visible again. Another way to make an LKM visible is using the imperius trick: https://github.com/MatheuZSecurity/Imperius …
VolWeb – A Centralized And Enhanced Memory Analysis Platform
VolWeb is a digital forensic memory analysis platform that leverages the power of the Volatility 3 framework. It is dedicated …
Douglas-042 – Powershell Script To Help Speed Up Threat Hunting Incident Response Processes
DOUGLAS-042 stands as an ingenious embodiment of a PowerShell script meticulously designed to expedite the triage process and facilitate the …
Prefetch-Hash-Cracker – A Small Util To Brute-Force Prefetch Hashes
Motivation During the forensic analysis of a Windows machine, you may find the name of a deleted prefetch file. While …
FACT – A Tool To Collect, Process And Visualise Forensic Data From Clusters Of Machines Running In The Cloud Or On-Premise
FACT is a tool to collect, process and visualise forensic data from clusters of machines running in the cloud or …
CSIRT-Collect – PowerShell Script To Collect Memory And (Triage) Disk Forensics
A PowerShell script to collect memory and (triage) disk forensics for incident response investigations. The script leverages a network share, …
Radare2 – UNIX-like Reverse Engineering Framework And Command-Line Toolset
r2 is a rewrite from scratch of radare. It provies a set of libraries, tools and plugins to ease reverse …
FAMA – Forensic Analysis For Mobile Apps
LabCIF – Forensic Analysis for Mobile Apps Getting Started Android extraction and analysis framework with an integrated Autopsy Module. Dump …