forensics

macOS (& ios) Artifact Parsing Tool

Security Apps for Android

A curated list of tools officially presented at Black Hat events

Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.

An OSINT / digital forensics tool built in Python

A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs

面向小白用户的 CTF / 逆向 Skills 整合包：自动分流、头脑风暴、教学模式、比赛模式、只提示模式

Automation and Scaling of Digital Forensics Tools

Practical Windows Forensics Training

Pure Python parser for Windows Event Log files (.evtx)

The Big Brother V6.0 is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.

operative framework is a rust investigation OSINT framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules.

SIEM Tactics, Techiques, and Procedures

Documentation and scripts to properly enable Windows event logs.

Collection of forensic tools

Tools OSINT MOBILE

Collection of Event ID ressources useful for Digital Forensics and Incident Response

Cross-platform incident response and live forensics toolkit with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.

:no_entry: (DEPRECATED) Diffy is a triage tool used during cloud-centric security incidents, to help digital forensics and incident response (DFIR) teams quickly identify suspicious hosts on which to focus their response.

A tool for forensic file system reconstruction.

This Python application is an OSINT (Open Source Intelligence) tool called "Ominis OSINT - Web Hunter." It performs online information gathering by querying Google for search results related to a user-inputted query. The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.

The ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run 11 advanced detection engines to uncover hidden payloads.

select * from logs; Tailpipe is an open source SIEM for instant log insights, powered by DuckDB. Analyze millions of events in seconds, right from your terminal.

A curated list of awesome Memory Forensics for DFIR

A single file container/archive that can be reconstructed even after total loss of file system structures

SIFT

A list of 350+ free TryHackMe rooms💻 to kick off your cybersecurity learning, organized by topics for easy exploration and practical skill-building !💀💥

Timeline of Active Directory changes with replication metadata

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.