Projects sharing features with Meerkat

This is a repository to centralize DFIR-related Mind Maps created with any Mind Mapping suites. The main point of this repo is to not only provide the Mind Maps for various DFIR Tools & Artifacts, but provide the source of the Mind Maps so others can use, improve, or modify how they see fit for…

A security analysis tool that identifies DNS queries made by browser extensions, empowering security teams to detect and investigate suspicious activities.

OpenProject is a guide on using open-source tools for Incident Response (IR). This repo shares workflows, tool setups, and practical steps for detecting, analyzing, and handling security incidents. It’s made for security pros and anyone interested in building an effective IR toolkit using free…

Whatsapp Parser Toolset Updated: May 2022

Tool designed to exfiltrate OneDrive Business OCR Data

androidqf (Android Quick Forensics) is a portable tool to simplify the acquisition of relevant forensic data from Android devices. It is the successor of Snoopdroid, re-written in Go and leveraging official adb binaries.

RdpCacheStitcher is a tool that supports forensic analysts in reconstructing useful images out of RDP cache bitmaps. Using raw RDP cache tile bitmaps extracted by tools like e.g. ANSSI's BMC-Tools (https://github.com/ANSSI-FR/bmc-tools) as input, it provides a graphical user interface and…

ripgrep is a command-line utility designed for searching through large file trees and source code repositories. It functions as a recursive text processor that traverses directories to locate and display matching patterns, serving as a high-performance alternative to traditional search tools. The tool distinguishes itself through a focus on execution speed and intelligent file handling. It utilizes a finite automata-based regular expression engine to ensure linear time complexity and employs hardware-level acceleration for literal byte sequence scanning. By integrating with version control sy

`bash # # `

`forensictools` is a toolkit designed for digital forensics, offering a wide array of tools. Its primary goal is to simplify the creation of a virtual environment for conducting forensic examinations.

1. The ADTimeline PowerShell script 1. Description 2. Prerequisites 3. Usage 4. Files generated 5. Custom groups 2. The ADTimeline App for Splunk 1. Description 2. Sourcetypes 3. AD General information dashboards 4. AD threat hunting dashboards 5. Enhance your traditional event logs threat…

To configure DFIR ORC, you need: configuration files in XML format, located in the "config" directory items to embed (especially DFIR-Orc binaries in 32 and 64 bits), stored in the "tools" directory

Digital Forensics Investigation Platform

A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.

A toolkit for the post-mortem examination of Docker containers from forensic HDD copies

CLI utility and Python module for analyzing log files and other data.

KAPE Files

Procmon (https://docs.microsoft.com/en-us/sysinternals/downloads/procmon) is a very powerful monitoring tool for Windows, capable of capturing file system, registry, process/thread and network activity.

A collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID.

Digital Forensics artifact repository

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.

Incident Response Triage - Windows Evidence Collection for Forensic Analysis

View and modify PDF metadata on Linux graphically

Pafish is an anti-analysis sandbox detector and virtualization environment tester. It serves as a diagnostic utility to identify if a system is running inside a virtual machine or a malware analysis sandbox by executing common anti-analysis techniques. The tool validates the effectiveness of various evasion methods and supports research into sandbox detection. It tests whether a target system can be recognized as a virtualized environment to help improve the stealth of malware analysis environments. Detection is achieved through a variety of behavioral checks, including hardware artifact ana