Skip to content
#

disk-forensics

Star

Here are 22 public repositories matching this topic...

Language: All
Filter by language
All 22 Python 6 Rust 4 Perl 2 C 1 Kotlin 1 PowerShell 1 Rich Text Format 1
Sort: Most stars
Sort options
Most stars Fewest stars Most forks Fewest forks Recently updated Least recently updated
TRACE-Forensic-Toolkit

Gadzhovski / TRACE-Forensic-Toolkit

Star 215

Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.

incident-response forensics dfir cybersecurity ntfs digital-forensics windows-registry yara file-recovery blue-team e01 file-carving forensics-investigations forensic-tools pyside6 windows-forensics disk-forensics forensics-tools digitalforensic dfir-tools
  • Updated Oct 7, 2026
  • Python

SecurityRonin / issen

Star 12

Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.

rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
  • Updated Aug 17, 2026
  • Rust

aniket2912 / All-CHFIv11-Modules-Reports

Star 6

Practical labs, case studies, and investigation notes for CHFI v11 — covering digital forensics, malware forensics, incident response, evidence collection, and analysis tools.

network-forensics data-acquisition digital-forensics computer-forensics memory-forensics mobile-forensics evidence-collection windows-forensics disk-forensics cyber-forensics linux-forensics malware-forensics chfi cyber-investigation cybercrime-investigation log-anaysis forensics-analysis
  • Updated Aug 31, 2025

SecurityRonin / ntfs-forensic

Star 1

From-scratch NTFS reader (ntfs-core: MFT, attributes, indexes, data runs, LZNT1, $UsnJrnl:$J change journal over Read+Seek) plus a graded anomaly auditor (ntfs-forensic: timestomping, alternate data streams, deleted records, MFT/LogFile tamper checks) — panic-free, fuzzed, no unsafe

rust security filesystem incident-response forensics dfir ntfs digital-forensics anti-forensics mft change-journal alternate-data-streams disk-forensics usn-journal timestomping rust-forensics
  • Updated Sep 21, 2026
  • Rust

cveburak / a-z-adli-bilisim

Star 0

🔍 Dijital Adli Bilişim (DFIR) A'dan Z'ye Türkçe kaynak. Disk, bellek, ağ, Windows, Linux, mobil ve bulut analizi. Volatility, Autopsy, Wireshark, KAPE kullanımı. Olay müdahale playbook'ları, malware analizi ve mahkeme raporu yazımı. 20 bölüm.

osint log-analysis network-forensics incident-response turkish forensics dfir cybersecurity wireshark siem malware-analysis digital-forensics kali-linux volatility turkce memory-forensics threat-intelligence blue-team autopsy disk-forensics
  • Updated Jul 3, 2026

Add this topic to your repo

To associate your repository with the disk-forensics topic, visit your repo's landing page and select "manage topics."

Learn more