A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.
macOS forensic acquisition made simple
Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.
Field reference for BTL1 and Tier 1 SOC work — grep-ready cheatsheets, SPL queries, Volatility workflows, live response commands
A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts
macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR
应急响应流量分析工具，支持pcap、excel、log等多种数据源，同时结合加解密、反编译等多个常用工作流。
AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic archives, or triage packages; AIFT discovers what can be opened, parses artifacts with Dissect, and uses AI to turn parsed data into concrete leads and gaps for the investigator to verify.
Interactive visual reference of 118 Digital Forensics & Incident Response (DFIR) tools organized into 9 categories. Includes a high-resolution printable poster.
Your AI Assistant for Weekend Forensics
A collection of PowerShell scripts for analyzing macOS Forensic Artifacts
Vault of Windows Registry forensic artifacts
A tool for fetching DFIR and other GitHub tools.
like ripgrep but for browser history
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
Automatically create iSCSI targets for all drives except for a boot device
Cryptocurrency Discovery and Triage Tool - Identify multiple cryptocurrency addresses and transactions from various wallet applications!
Casting light on shadow cloud deployments. Detect exposure of resources deployed in AWS or GCP.
Outil de triage automatisé de différents types de collectes d'artefacts.
To associate your repository with the dfir-tools topic, visit your repo's landing page and select "manage topics."