forensic-tools

A list of free and open forensics analysis tools and other resources

Collaborative Incident Response platform

macOS forensic acquisition made simple

macos-collector - Automated Collection of macOS Forensic Artifacts for DFIR

A collection of PowerShell scripts for analyzing macOS Forensic Artifacts

Neural network RDP cache reconstruction tool

C# Library and research notes for Windows 11 Notepad State Files

Automatically create iSCSI targets for all drives except for a boot device

Is a portable forensic tool for analyzing Windows logs, pre-organized according to the methodology outlined in this job: https://cybersecuritynews.com/windows-event-log-analysis/, to quickly highlight key forensic artifacts.

Digital Forensics Essentials (DFE)

Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.

VMDetect is a Python based Windows VM detection and environment forensics tool that reads ACPI/SMBIOS firmware tables and system artifacts to expose virtual machines, even if people try to hide them!

Reverse Engineering the Tabstate files for Windows Notepad

Decryption tool for LockMyPix android app

DFLER: Drone Flight Log Entity Recognizer to Support Forensic Investigation on Drone Device

Valhuntir SIFT platform — MCP servers, gateway, Examiner Portal

Linux last-logon forensic auditing from the binary lastlog database.

Zero-dependency Python CLI for targeted file collection - digital forensics, incident response, and selective backups. Cross-platform, with SHA-256 manifests, chain-of-custody logging, and checkpoint/resume for failing media.

Production-ready Multimodal Lip Sync Detection & Deepfake Detection System. Detects audio-video synchronization mismatches using deep learning (PyTorch) with a scalable FastAPI-based inference pipeline. Optimized for real-time processing,low false positives, and robust performance on noisy speech segments. Built for video forensics,synthetic media