Projects sharing features with Timesketch

WELA (Windows Event Log Analyzer, ゑ羅) is a tool for auditing Windows event log settings. Windows event logs are a vital source of information for Digital Forensics and Incident Response (DFIR), providing visibility into system activity and security events.

Indico - A feature-rich event management system, made @ CERN, the place where the Web was born.

SecureDrop is an integrated software suite designed for anonymous whistleblowing and encrypted document leaks. It provides a platform for the secure transfer of sensitive files and a communication portal for two-way encrypted messaging between organizations and anonymous sources. The system ensures identity protection by integrating onion routing to mask network locations and using asymmetric cryptography for secure communication. It incorporates a metadata-stripping pipeline to remove identifying information from uploaded files before they are reviewed. For data handling, the platform utili

Rekall Memory Forensic Framework

LogonTracer is a security auditing tool designed for logon analysis and forensic log auditing. It functions as a dockerized security auditor that utilizes a security event graph database to map account names and network addresses, allowing for the visualization of complex system compromise patterns and authentication paths. The system features a Sigma detection engine that scans imported event logs against standardized rule sets to identify known malicious activity. It also includes an anomalous behavior detector that applies statistical analysis, graph algorithms, and hidden Markov models to

Version 0.9 - beta

CyLR - Live Response Collection Tool

Live tracking, flight database and competition framework

Hayabusa is a Windows event log analyzer, threat hunting tool, and forensic timeline generator. It functions as a detection engine that applies threat patterns to logs to identify suspicious behavior and security threats. The project distinguishes itself through the ability to synchronize detection rules from remote repositories and tune risk levels to prioritize critical alerts. It also provides specialized forensic capabilities, such as extracting event log data into chronological records for incident response investigations. The tool's broader capabilities include security log enrichment

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools (https://github.com/ANSSI-FR/bmc-tools) as input, it provides a graphical user interface and…

FlaskBB is a forum software for building online communities and structured discussions, developed using the Flask web framework. It provides a system for organizing public conversations, rendering rich text via a Markdown processor, and managing a multilingual localization engine to support global audiences. The platform features an extensible plugin framework that allows for the addition of custom logic and new features to the core forum functionality. Access is managed through a role-based access control system that assigns permissions to user groups to restrict or grant access to specific

Digital Forensics artifact repository

Digital Forensics Investigation Platform

APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity

PowerForensics provides an all in one platform for live disk forensic analysis

A rewrite of mactime, a bodyfile reader

SRUM-DUMP extracts data from the System Resource Utilization Management (SRUM) database and generates an Excel spreadsheet. This tool is invaluable for forensic investigations, as SRUM maintains records of applications that have run on a system within the last 30 days.

AVML - Acquire Volatile Memory for Linux

Dispatch is an incident response orchestration platform that automates the coordination of detection, participant assembly, and task tracking across existing communication and project management tools. It provides a web-configurable state machine to manage incident lifecycle transitions, with template-driven incident models that define types, priorities, and severity levels. The platform enforces role-based access control to map user roles to specific actions and data access, while maintaining a database-backed audit trail of all incident events and system changes for compliance and post-incid

GRR is a distributed incident response platform and asynchronous forensic task orchestrator. It functions as a remote forensics framework designed to collect and analyze volatile data, system memory, and digital artifacts from remote hosts during security incident response. The system operates as a remote endpoint triage system, utilizing a coordinated architecture to manage a fleet of agents. It enables the execution of investigative tasks across multiple systems, allowing for the search of files and registries across a large fleet of machines to identify compromised hosts. The platform pro

Avilla Forensics is a free mobile forensic tool created in February 2021 to assist investigators in collecting information and evidence from mobile devices. Developed by Daniel Avilla, a police officer from São Paulo, the tool provides powerful features for logical data extraction and backup…

DFIR Artifact Museum