sleuth-kit

A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms

Proof of concept forensic triage using rust and tsk. This does not work yet.

A Claude Code skill for forensic analysis of computer disk images.

Autonomous DFIR agent for SIFT - cited findings, audited actions, zero hallucinated evil.

Safety-first guide for corrupted video recovery from cameras, phones, drones, dashcams, CCTV, and storage media, with tested MP4/H.264/FAT32 tools.

End-to-end digital forensics lab — forensic image acquisition with FTK Imager (E01 format, MD5/SHA-1 verification) and deleted file recovery & artifact analysis with Autopsy (The Sleuth Kit). Recovered 70+ deleted files from unallocated NTFS sectors. Educational DFIR project aligned with NIST SP 800-86.

Provides hands-on Docker-based labs for digital forensics and incident response training, featuring memory analysis, network analysis, and malware detection tools like Volatility, Sleuth Kit, and YARA.

End-to-end Windows DFIR investigation using NTFS artefacts, PowerShell history, Windows Event Logs, Edge SQLite analysis and timeline reconstruction.