A repo that aims to centralize a current, running list of relevant parsers/tools for known DFIR artifacts

A hex viewer for the sleuths!

CLI tools for forensic investigation of Windows artifacts

Defcon Arsenal Tools (DArT) is a curation of tools presented at DEF CON, the world's largest hacker con.

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.

iOS Logs, Events, And Plist Parser

A free program for extracting data (like voicemails) from iPhone and iPad backups.

FUSE driver for APFS (Apple File System)

linux c++, fox-toolkit, multi-threaded forensic gui tool

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation b…

Automation and Scaling of Digital Forensics Tools

This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.

Digital Forensics Investigation Platform

Forensics acquisition framework designed to be extensible and secure

DFF (Digital Forensics Framework) is a Forensics Framework coming with command line and graphical interfaces. DFF can be used to investigate hard drives and volatile memory and create reports about…

Forensics Wiki, a wiki devoted to information about digital forensics (also known as computer forensics)

This is a prototype system that uses Hadoop to process hard drive images.

The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digi…

Python Module for parsing Binary Property List and NSKeyedArchiver files

Library and tools to access the Windows XML Event Log (EVTX) format

Library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.

Library and tools to access the Personal Folder File (PFF) and the Offline Folder File (OFF) format

Intella crawler script documentation and samples

🚨 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system

Quick iOS Backup UnFunkerizor

Web browser forensics for Google Chrome/Chromium

Forensic Artifact Collection Tool for macOS

AutoMacTC: Automated Mac Forensic Triage Collector

Apple Pattern of Life Lazy Output'er

Scripts to process macOS forensic artifacts