Digital Forensics Artifacts Knowledge Base
updated at Nov. 2, 2024, 12:41 a.m.
A Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response.
updated at Nov. 1, 2024, 5:08 p.m.
CrowdStrike Falcon Orchestrator provides automated workflow and response capabilities
updated at Oct. 30, 2024, 3:26 p.m.
$MFT directory tree reconstruction & FILE record info
updated at Oct. 29, 2024, 9:41 p.m.
Forensic tool for acquisition, triage and analysis of remote block devices via iSCSI protocol.
updated at Oct. 25, 2024, 7:56 a.m.
Binary analysis and management framework
updated at Oct. 25, 2024, 1:49 a.m.
DPS' Lightweight Investigation Notebook
updated at Oct. 24, 2024, 2:56 a.m.
Incident Response Forensic Framework
updated at Oct. 23, 2024, 6:23 p.m.
A Python DNS crawler to find identical domain names under different TLDs.
updated at Oct. 22, 2024, 7:12 p.m.
Cyber Incident Response Team Playbook Battle Cards
updated at Oct. 21, 2024, 2:10 p.m.
Investigate suspicious activity by visualizing Sysmon's event log
updated at Oct. 21, 2024, 10:37 a.m.
Traceroute improved wrapper for CSIRT and CERT operators
updated at Oct. 9, 2024, 6:38 a.m.
A Python library and command line tools to provide interactive log visualization.
updated at Oct. 3, 2024, 5:12 a.m.
A Python library to interface with a cuckoo-modified instance
updated at Oct. 3, 2024, 5:12 a.m.