A list of free and open forensics analysis tools and other resources
Collaborative Incident Response platform
macOS forensic acquisition made simple
Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.
Read-only MBR/GPT inspection, public file signature definitions, and synthetic disk image tools. AGPL-3.0-only.
macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
Neural network RDP cache reconstruction tool
A collection of PowerShell scripts for analyzing macOS Forensic Artifacts
C# Library and research notes for Windows 11 Notepad State Files
Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.
Automatically create iSCSI targets for all drives except for a boot device
Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal
Digital Forensics Essentials (DFE)
VMDetect is a Python based Windows VM detection and environment forensics tool that reads ACPI/SMBIOS firmware tables and system artifacts to expose virtual machines, even if people try to hide them!
Is a portable forensic tool for analyzing Windows logs, pre-organized according to the methodology outlined in this job: https://cybersecuritynews.com/windows-event-log-analysis/, to quickly highlight key forensic artifacts.
Reverse Engineering the Tabstate files for Windows Notepad
Get-NetScalerTimeline - Automated File System Timeline Creation for NetScaler ADC/Gateway (DFIR)
Decryption tool for LockMyPix android app
DFLER: Drone Flight Log Entity Recognizer to Support Forensic Investigation on Drone Device
Linux last-logon forensic auditing from the binary lastlog database.
To associate your repository with the forensic-tools topic, visit your repo's landing page and select "manage topics."