Forensics Libraries

27 Components & Libraries

Sortby

Forensics Libraries

Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more

It contains hundreds of controls covering CIS, NIST 800, NIST CSF, CISA, RBI, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, AWS Well-Architected Framework Security Pillar, AWS Foundational Technic…

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Note: python-oletools is not related to OLETools published by BeCubed Software. This is a personal open-source project, developed on my spare time. Any contribution, suggestion, feedback or bug repor…

BleachBit system cleaner for Windows and Linux

BleachBit cleans files to free disk space and to maintain privacy. To run BleachBit without installation, unpack the tarball and then run these commands: Then, review the preferences. Then, select so…

:snowflake: PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction

Wiki has more help too. Given a Pcap File, plot a network diagram displaying hosts in the network, network traffic, highlight important traffic and Tor traffic as well as potential malicious traffic …

Cortex: a Powerful Observable Analysis and Active Response Engine

Cortex is written in Scala. The front-end uses AngularJS with Bootstrap. Its REST API is stateless which allows it to be horizontally scalable. The provided analyzers are written in Python. Additiona…

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

RecoverPy is a powerful tool that leverages your system capabilities to recover lost files. Every block of your partition will be scanned. You can even find a string in binary files. To install all d…

ThePhish: an automated phishing email analysis tool

The following diagram shows how ThePhish works at high-level: This example aims to demonstrate how a user can send an email to ThePhish for it to be analyzed and how an analyst can actually analyze t…

Pure Python parser for Windows Event Log files (.evtx)

python-evtx is a pure Python parser for recent Windows Event Log files (those with the file extension ".evtx"). The module provides programmatic access to the File and Chunk headers, record template…

Volatility plugin for extracts configuration data of known malware

MalConfScan can dump the following malware configuration data, decoded strings or DGA domains: MalConfScan has a function to list strings to which malicious code refers. Configuration data is usually…

Cortex Analyzers Repository

Poseidon is a python-based application that leverages software defined networks (SDN) to acquire and then feed network traffic to a number of machine learning techniques. The machine learning algorithms classify and predict the type of device.

Software Defined Network Situational Awareness Followed by closing the existing shell and starting a new one. Install the poseidon script which we will use to install and manage Poseidon. If you have…

Poseidon is a python-based application that leverages software defined networks (SDN) to acquire and then feed network traffic to a number of machine learning techniques. The machine learning algorithms classify and predict the type of device.

Uscrapper 2.0, a powerful OSINT webscraper for personal data collection. Uscrapper uses web scraping to extract email IDs, social-media links, geolocations, phone numbers, and usernames from webpages, supports multithreading, has advanced Anti-webscraping bypassing modules, supports webcrawling to scrape from various sublinks within the same domain

Uscrapper extracts the following details from the provided website: Uscrapper 2.0: To run Uscrapper, use the following command-line syntax: Uscrapper relies on web scraping techniques to extract i…

Query and report user logons relations from MS Windows Security Events

This tool automates the process of creating logon relations from MS Windows Security Events by showing a graphical relation among users domains, source and destination logons as well as session durat…

Imago is a python tool that extract digital evidences from images.

Imago is a python tool that extract digital evidences from images recursively. This tool is useful throughout a digital forensic investigation. If you need to extract digital evidences and you have …

Python script to decode common encoded PowerShell scripts

Python script to decode common encoded PowerShell scripts. Hope you find it helpful! Even more hacked together by @JohnLaTwC, Nov 2016 v 0.6 With apologies to @Lee_Holmes for using Python instead of …

Python package for detecting copy-move attack on a digital image

This is a python package for detecting copy-move attack on a digital image. the above output means there are 5 possible matched/identical region with 2178 overlapping blocks on each of it Example out…

Python 3 Script to parse out iTunes backups

Python 3 Script to read iTunes Backups (Due to a bug in biplist, the script will not work on Python 3.9, please use a lower version of Python or one of the frozen exe's) Usage: Backups located in C:\…

Copy-move forgery detection on digital image using Python

This is an implementation of python script to detect a copy-move manipulation attack on digital image based on Overlapping Blocks. This script is implemented with a modification of two algoritms publ…

Forensic Analysis for Mobile Apps (FAMA) -- module for the Autopsy Forensic Browser

Android extraction and analysis framework with an integrated Autopsy Module. Dump easily user data from a device and generate powerful reports for Autopsy or external applications. The script can be …

CLI utility and Python module for analyzing log files and other data.

Logdissect is a CLI utility and Python library for analyzing log files and other data. It can parse, merge, filter, and export data (to log files, or JSON). Re-parsing: If you are planning on parsing…

BusKill's main CLI/GUI app for arming/disarming/configuring the BusKill laptop kill cord

BusKill is a laptop kill cord that can trigger your computer to lock or shutdown when it's physically separated from you. To read our comprehensive documentation, see: For instructions on downloading…

WhatMail is a command-line tool that analyzes the header of an email and provides detailed information about various fields.

Carves and recreates VSS catalog and store from Windows disk image.

Carves and recreates VSS catalog and store from Windows disk image. Of course, you can build them by yourself as same as Linux or macOS.

Python programs & tools built in the Ethical Hacking with Python EBook

More Python programs will be added to this repository as the book will be constantly improved and enriched. The tools and scripts are:

Quickly analyze and explore email with advanced analytics and visualization.

Email is a challenge to visualize. The Newman tool and accompanying analytics contain a processing component, email analytics, visualization and discovery tools. Newman can quickly analyze and explor…