A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
A simple-to-use IR (incident response) case management tool for tracking and documenting investigations.
macOS forensic acquisition made simple
Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.
AIFT is a GUI, CLI, REST API, and MCP tool that helps DFIR analysts get oriented quickly. Point it at disk images, VM images, forensic archives, or triage packages; AIFT discovers what can be opened, parses artifacts with Dissect, and uses AI to turn parsed data into concrete leads and gaps for the investigator to verify.
Your AI Assistant for Weekend Forensics
Open-source memory forensics platform for DFIR, threat hunting, malware analysis, and incident response.
Automatically create iSCSI targets for all drives except for a boot device
Cryptocurrency Discovery and Triage Tool - Identify multiple cryptocurrency addresses and transactions from various wallet applications!
Casting light on shadow cloud deployments. Detect exposure of resources deployed in AWS or GCP.
UAL Timeline Generator — User Access Logging Timeliner
A deployment and testing platform for Velociraptor's client artifacts
A comprehensive Automation Compromise Assessmnt tool that collects, parses, and analyzes Windows and Linux artifacts, detects malicious activities, and maps findings to the MITRE ATT&CK framework.
Yerel ağlarda anomaly detection, saldırı tespiti ve adli bilişim analizi yapan tek Pythontkinter tabanlı açık kaynak araç. Özelleştirilebilir imza veritabanıyla Türkiye odaklı tehditleri yakalar!
Zero-dependency Python CLI for targeted file collection - digital forensics, incident response, and selective backups. Cross-platform, with SHA-256 manifests, chain-of-custody logging, and checkpoint/resume for failing media.
Security Incident Response case-management platform with a local-LLM investigation copilot, IR playbook marketplace, telemetry dashboard, investigation graph, and per-organization SAML SSO.
AI-native digital forensics & cybercrime investigation platform. 7 MCP servers (Volatility3, Ghidra, Wireshark, OSINT, threat-intel & more) orchestrated by Claude, ChatGPT, or Ollama — fully containerized, chain-of-custody enforced, court-admissible output.
YaFT2 - Yet Another Forensic Tool
Convert USN Journal Records to Event Logs
To associate your repository with the dfir-tools topic, visit your repo's landing page and select "manage topics."