Sigcheck ^New!

0 reviews

docs.microsoft.com/en-us/sysinternals/downloads/sigcheck

Sigcheck is a command-line utility that shows file version number, timestamp information, and digital signature details, including certificate chains. It also includes an option to check a file’s status on VirusTotal, a site that performs automated file s ...

TZWorks Portable Executable Scanner (pescan) ^{New! Popular}

0 reviews

tzworks.net/prototype_page.php?proto_id=15

pescan is a command line tool to scan portable executable (PE) files to identify how they were constructed. Various metadata is displayed, identifying items such as: Compile timestamp MACB timestamp File size and type of executable Target OS and ...

Elcomsoft Internet Password Breaker ^{New! Popular}

0 reviews

www.elcomsoft.com/einpb.html

"Elcomsoft Internet Password Breaker instantly reveals passwords to Web sites, identities, and mailboxes stored in a variety of applications. Supporting all versions of Internet Explorer up to IE8, Firefox, Safari, Chrome, and Opera, all versions of Outlo ...

grafana/loki ^New!

0 reviews

github.com/grafana/loki

Loki: like Prometheus, but for logs. Loki is a horizontally-scalable, highly-available, multi-tenant log aggregation system inspired by Prometheus. It is designed to be very cost effective and easy to operate, as it does not index the contents of the log ...

ArtifactExtractor ^Popular

0 reviews

github.com/Silv3rHorn/ArtifactExtractor

ArtifactExtractor is a script that extracts common Windows artifacts from source images and VSCs. Artifacts in VSCs will be checked (via hash) if they are different from a later VSC/image copy before extraction.

AChReport

0 reviews

github.com/OMENScan/AChReport

AChReport is a Python Report Writer for AChoir AChReport IS NOT meant as a comprehensive reporting tool. It's power is in extracting the most important information and presenting it in an easy to understand format. AChReport IS NOT meant to replace your ...

Attack Defense

0 reviews

attackdefense.com

Zetx Trax

0 reviews

zetx.com

From the minute a target number is identified, to the moment it is presented to a jury, ZetX covers every aspect to include basic investigative training to Subject Matter Expert certifications. ZetX is home to the original Free Phone Look Up tool alon ...

MantaRay Forensics

0 reviews

sourceforge.net/projects/mantarayforensics/files/VirusShare_...

VirusShare.com 0-337 hash sets were converted to RAW, EnCase and Autopsy format. All hash sets (0-337) were added to one file and duplicates were removed. NSRL Modern v2.62 was compared to the unique set and matches were removed. Additionally, the zero by ...

autotimeliner

0 reviews

github.com/andreafortuna/autotimeliner

Automagically extract forensic timeline from volatile memory dumps. Requirements Python Volatility mactime (from SleuthKit) How it works AutoTimeline automates this workflow: Identify correct volatility profile for the memory image. Runs the timeliner plu ...

Arsenal Recon HbinRecon

0 reviews

arsenalrecon.com

HbinRecon identifies and parses Windows® Registry hive bins (hbins) from any input. Hive bins are essentially the building blocks of Registry hives. Examples of HbinRecon input include healthy Registry hives, fragmented hives, hive transaction logs, and u ...

Arsenal Recon HiveRecon

0 reviews

arsenalrecon.com

HiveRecon extracts Registry hives from Windows® hibernation and crash dump files, often extracting hives when other solutions have completely failed and extracting healthier (more intact) hives when other solutions have appeared to run successfully. HiveR ...

Forensic7z

0 reviews

www.tc4shell.com/en/7zip/forensic7z/

Forensic7z is a plugin for the popular 7-Zip archiver. You can use Forensic7z to open and browse disk images created by specialized software for forensic analysis, such as Encase or FTK Imager. At the moment, the Forensic7z plugin supports images in the ...

EviGator iStalker ^Popular

0 reviews

evigator.com/free-apps/istalkr

"iStalkr is a program that parses the consolidated.db file from iOS4.x devices. Individual locations can be viewed using the integrated map viewer and locations can be exported to KML for use in Google Earth."evigator.com/free-apps/istalkr

Cointel

0 reviews

www.cointel.eu

Cointel provides insights in Bitcoin and Zcash transactions. Using advanced clustering techniques spent analysis of specific suspects can be generated. Moreover the possibility for notifications on specific transactions or address activity as well as adva ...

Arsenal Recon CyberGate Keylogger Decryption Tool

0 reviews

github.com/ArsenalRecon/CyberGateLogDecrypt

Arsenal's CyberGate Keylog Decrypter script is a python tool that can be used against CyberGate encrypted keylogger files (either whole or in part, provided that the individual record is intact) to decode the cipher text and return the original plaintext ...

Arsenal Recon Backstage Parser

0 reviews

github.com/ArsenalRecon/BackstageParser

Arsenal's Backstage Parser is a python tool that can be used to parse the contents of Microsoft Office files found in the “\Users(User)\AppData\Local\Microsoft\Office\16.0\BackstageinAppNavCache” path. David Cowen from C-G Partners blogged in October 2 ...

Timeline Explorer

0 reviews

ericzimmerman.github.io/#!index.md

View CSV and Excel files, filter, group, sort, etc. with ease

RecentFileCacheParser

0 reviews

ericzimmerman.github.io/#!index.md

RecentFileCache parser