Stars
Parse Windows Prefetch files: Supports XP - Windows 10 Prefetch files
Forensic tool that parses AppCompatibility key more known as Shimcache, and returns all it's content.
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Automated, Collection, and Enrichment Platform
The Cyber Swiss Army Knife - a web app for encryption, encoding, compression and data analysis
The start of a be-all end-all for Linux mounting of VMDK's, EWF's, and dd's
openioc_scan Volatility Framework plugin
Libewf is a library to access the Expert Witness Compression Format (EWF)
An informational repo about hunting for adversaries in your IT environment.
Arkime is an open source, large scale, full packet capturing, indexing, and database system.
Slides and Other Resources from my latest Talks and Presentations
Log newly created WMI consumers and processes to the Windows Application event log
GRR Rapid Response: remote live forensics for incident response
Presentation Archives for my macOS and iOS Related Research
An advanced memory forensics framework
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digi…