A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.
macOS forensic acquisition made simple
Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.
Field reference for BTL1 and Tier 1 SOC work — grep-ready cheatsheets, SPL queries, Volatility workflows, live response commands
A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts
macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic archives, or triage packages; AIFT discovers what can be opened, parses artifacts with Dissect, and uses AI to turn parsed data into concrete leads and gaps for the investigator to verify.
应急响应流量分析工具，支持pcap、excel、log等多种数据源，同时结合加解密、反编译等多个常用工作流。
Interactive visual reference of 118 Digital Forensics & Incident Response (DFIR) tools organized into 9 categories. Includes a high-resolution printable poster.
A collection of PowerShell scripts for analyzing macOS Forensic Artifacts
Vault of Windows Registry forensic artifacts
like ripgrep but for browser history
A tool for fetching DFIR and other GitHub tools.
Your local AI assistant for weekend forensic work.
Casting light on shadow cloud deployments. Detect exposure of resources deployed in AWS or GCP.
Cryptocurrency Discovery and Triage Tool - Identify multiple cryptocurrency addresses and transactions from various wallet applications!
Automatically create iSCSI targets for all drives except for a boot device
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
Outil de triage automatisé de différents types de collectes d'artefacts.
To associate your repository with the dfir-tools topic, visit your repo's landing page and select "manage topics."