Forensics Open Source Projects

🔍 A Hex Editor for Reverse Engineers, Programmers and people who value their retinas when working at 3 AM.

UNIX-like reverse engineering framework and command-line toolset

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

eBPF-powered network observability for Kubernetes. Indexes L4/L7 traffic with full K8s context, decrypts TLS without keys. Queryable by AI agents via MCP and humans via dashboard.

A curated list of CTF frameworks, libraries, resources and softwares

A curated list of tools for incident response

An Information Security Reference That Doesn't Suck; https://rmusser.net/git/admin-2/Infosec_Reference for non-MS Git hosted version.

⭐️ A curated list of awesome forensic analysis tools and resources

GRR Rapid Response: remote live forensics for incident response

Free Security and Hacking eBooks

Volatility 3.0 development

Official Black Hat Arsenal Security Tools Repository

Awesome hacking is an awesome collection of hacking tools.

Rapidly Search and Hunt through Windows Forensic Artefacts

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

Collaborative forensic timeline analysis

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

Autopsy® is a digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools. It can be used by law enforcement, military, and corporate examiners to investigate what happened on a computer. You can even use it to recover photos from your camera's memory card.

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.

Digital Forensics Guide. Learn all about Digital Forensics, Computer Forensics, Mobile device Forensics, Network Forensics, and Database Forensics.

This repository aims to hold suggestions (and hopefully/eventually code) for CTF challenges. The "project" is nicknamed Katana.

Free hands-on digital forensics labs for students and faculty

🕵️ OSINT Tools for gathering information and actions forensics 🕵️

A list of free and open forensics analysis tools and other resources

Hacker tools on Go (Golang)

Super timeline all the things

Educational, CTF-styled labs for individuals interested in Memory Forensics

Complete Solution for VAPT/AppSec and Pentesting Guide: Web | Mobile | API | Thick Client | Source Code Review | DevSecOps | Wireless | Network Pentesting | SAST | DAST etc...

:snowflake: PcapXray - A Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification, highlight important communication and file extraction

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

TCP/IP packet demultiplexer. Download from:

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

Web browser forensics for Google Chrome/Chromium

Sparrow.ps1 was created by CISA's Cloud Forensics team to help detect possible compromised accounts and applications in the Azure/m365 environment.

UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.

Expose USB activity on the fly

Digital Forensics artifact repository

a list of 350+ Free TryHackMe rooms to start learning cybersecurity with THM

Tracking history of USB events on GNU/Linux

Avilla Forensics FREE

macOS (& ios) Artifact Parsing Tool

Security Apps for Android

Automation and Scaling of Digital Forensics Tools

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.

A collection of OSX and iOS security resources

Uscrapper Vanta: Dive deeper into the web with this powerful open-source tool. Extract valuable insights with ease and efficiency, from both surface and deep web sources. Empower your data mining and analysis with Vanta's advanced capabilities. Fast, reliable, and user-friendly, Uscrapper Vanta is the ultimate choice for researchers and analysts.

Practical Windows Forensics Training

Pure Python parser for Windows Event Log files (.evtx)

operative framework is a rust investigation OSINT framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules.

Everything related to Linux Forensics

SIEM Tactics, Techiques, and Procedures

Documentation and scripts to properly enable Windows event logs.

Collection of forensic tools

Tools OSINT MOBILE

OSINT Swiss Army Knife

Awesome Forensics Resources. Almost 300 open source forensics tools, and 600 blog posts about forensics.

Collection of Event ID ressources useful for Digital Forensics and Incident Response

Collection of scripts and resources for DevSecOps and Automated Incident Response Security

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.