Forensics

DFIR tools to add capabilities for the analyses of protocols and data

AD-Replication-Metadata	DescriptionThis simple script allows you to track past changes on your AD objects, even if event logs were wiped (e.g. during an Incident Response), using Replication metadata history. No special permissions needed (no admin required).	https://github.com/YossiSassi/AD-Replication-Metadata
AnalyzePDF	Analyzes PDF files by looking at their characteristics in order to add some intelligence into the determination of them being malicious or benign.	https://github.com/hiddenillusion/AnalyzePDF
AudioStego	Tool for hiding and retreiving information from audio files	https://github.com/danielcardeenas/AudioStego
AutoVolatility	Run all plugins for Volatility and pass reports out into folder structure for review	https://github.com/carlospolop/autoVolatility
Binwalk	Firmware Analyses Tool. Extract files, view Hex etc	https://github.com/ReFirmLabs/binwalk
BruteShark	BruteShark is a Network Forensic Analysis Tool (NFAT) that performs deep processing and inspection of network traffic (mainly PCAP files)	https://github.com/odedshimon/BruteShark
Deepix	Depix is a tool for recovering passwords from pixelized screenshots	https://github.com/beurtschipper/Depix
Exif Tool	Offline EXIF identification and manipulation tool	https://exiftool.org/
Extundelete	Extundelete is a utility to undelete files from an ext3 or ext4 partition	https://sourceforge.net/projects/extundelete/
Face_recognition	Basic Python script for facial recognition	https://github.com/ageitgey/face_recognition
Freq-PS	PowerShell Script to analyse objects in order to determine randomness. For example analysing domain names for DGA's	https://github.com/jcjohnson34/Freq-PS
Foremost	DFIR file carving tool. Link is for Source build. Prebuilt found on SourceForge	https://github.com/jonstewart/foremost
Ghiro	Forensic analysis and report generation tool for images	https://github.com/Ghirensics/ghiro
Hayabusa	Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool	https://github.com/Yamato-Security/hayabusa
Hoarder	Hoarder is a script made to collect and parse the most valuable artifacts for forensics or incident response investigations rather than imaging the whole hard drive	https://github.com/muteb/Hoarder
NetworkMiner	NetworkMiner is an open source Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD).	https://www.netresec.com/index.ashx?page=NetworkMiner
Orochi	Orochi is an open source framework for collaborative forensic memory dump analysis.	https://github.com/LDO-CERT/orochi
Peepdf	Python tool to explore PDF files	https://github.com/jesparza/peepdf
pyWhat	what's job is to identify what something is. Whether it be a file or text! Or even the hex of a file! What about text within files? We have that too! what is recursive, it will identify everything in text and more!	https://github.com/bee-san/pyWhat
Sonic Visualiser	Audio Analyses Tool	https://www.sonicvisualiser.org
ssh_decoder	Can decrypt ssh connections if one end is using vulnerable openssl - from PCAP	https://github.com/jjyg/ssh_decoder
StegCracker	Steganography brute-force utility to uncover hidden data inside files	https://github.com/Paradoxis/StegCracker
Stego-toolkit	Many tools for Steganography challenges in one package. Can be run in docker.	https://github.com/DominicBreuker/stego-toolkit
Stegsolv	Steganography solving tool for image formats	https://github.com/zardus/ctf-tools/blob/master/stegsolve/install
unredacter	Shows you why you should never ever ever use pixelation as a redaction technique. For a more complete writeup of how this works, check out my blog post here.	https://github.com/BishopFox/unredacter
ViperMonkey	ViperMonkey is a VBA Emulation engine written in Python, designed to analyze and deobfuscate malicious VBA Macros contained in Microsoft Office files (Word, Excel, PowerPoint, Publisher, etc).	https://github.com/decalage2/ViperMonkey
Volatility	DFIR tool for analyzing data in dumped file formats	https://volatilityfoundation.org
Volatility Workbench	GUI for Volatility	https://www.osforensics.com/tools/volatility-workbench.html
VolUtility	Web Interface for Volatility Memory Analysis framework	https://github.com/kevthehermit/VolUtility
Win10_Volatility	Volatility with additional support for Win 10	https://github.com/fireeye/win10_volatility
Wireshark	Network packet analyser	https://wireshark.org