zawadidone Goto Github PK

acquire

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

albeda

argus

artifacts

Digital Forensics Artifact Repository

atc-react

A knowledge base of actionable Incident Response techniques

atop-parser

Pure python (partial) ATOP binary file parser using dissect.cstruct

avml

AVML - Acquire Volatile Memory for Linux

carbonblackcloud-extractor

Carbon Black Cloud Events extractor

community3

Volatility3 plugins developed and maintained by the community

detection-rules

Collection of YARA-L 2.0 sample rules for the Chronicle Detection API

dfir-lab

dfirartifactmuseum

The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifacts that may no longer be readily available anymore.

dissect-docs

Dissect documentation project

dissect.cim

A Dissect module implementing a parser for the Windows Common Information Model (CIM) database, used in the Windows operating system.

dissect.clfs

A Dissect module implementing a parser for the CLFS (Common Log File System) file system of Windows.

dissect.contrib

This project is a meta package. It reserves the namespace for Dissect packages made by external contributors.

dissect.cstruct

A Dissect module implementing a parser for C-like structures.

dissect.esedb

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.

dissect.etl

A Dissect module implementing a parser for Event Trace Log (ETL) files, used by the Windows operating system to log kernel events.

dissect.eventlog

A Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats.

dissect.evidence

A Dissect module implementing a parsers for various forensic evidence file containers, currently: AD1, ASDF and EWF.

dissect.extfs

A Dissect module implementing a parser for the ExtFS file system, the native filesystem for Linux operating systems.

dissect.fat

A Dissect module implementing parsers for the FAT and exFAT file systems, commonly used on flash memory based storage devices and UEFI partitions.

dissect.ffs

A Dissect module implementing a parser for the FFS file system, commonly used by BSD operating systems.

dissect.hypervisor

A Dissect module implementing parsers for various hypervisor disk, backup and configuration files.

dissect.ntfs

A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system.

dissect.ole

A Dissect module implementing a parser for the Object Linking & Embedding (OLE) format, commonly used by document editors on Windows operating systems.

dissect.regf

A Dissect module implementing a parser for Windows registry file format, used to store application and OS configuration on Windows operating systems.

dissect.shellitem

A Dissect module implementing a parser for the Shellitem structures, commonly used by Microsoft Windows.

dissect.sql

A Dissect module implementing a parsers for the SQLite database file format, commonly used by applications to store configuration data.