An extensible open format for the storage of disk images and related forensic.information.

A GUI front-end to dd/dc3dd designed for easily creating forensic images.

Tool for copying largely sparse files using information from a block map file.

A patched version of dd that includes a number of features useful for computer forensics.

DCFL (DoD Computer Forensics Lab), a dd replacement with hashing.

GNU data recovery tool.

A CLI tool to uncompress Apple's compressed DMG files to the HFS+ IMG format.

Dynamic instrumentation toolkit for developers, reverse-engineers, and security researchers.

A universal memory dumper using Frida.

Command line utility and Python package to ease the (un)mounting of forensic disk images.

Utility for recovering deleted files from ext2, ext3 or ext4 partitions by parsing the journal.

A console program to recover files based on their headers, footers, and internal data structures.

Find and recover deleted files on block devices.

Dumps system memory to stdout, skipping over holes in memory maps.

Simple utility that can be used to dump process memory of any userspace process running on the system without…

Memory Extractor & Analyzer.

Recover jpegs from damaged devices.

A disk data recovery tool to extract data from damaged media.

Data recovery program for NTFS file systems.

TestDisk checks the partition and boot sectors of your disks. It is very useful in recovering lost partitions.…

The forensic browser. A GUI for the Sleuth Kit.

Bulk Email and URL extraction tool.

Malicious HTTP traffic explorer tool.

A Cross-Platform Forensic Framework for Google Chrome.

A Cross Platform Forensic Framework for Skype.

A forensic tool for firefox.

Analyze MIME files.

Examine the contents of the IE's cookie files for forensic purposes.

A forensic imager for media acquisition.

A Tool suite for inspecting NTFS artifacts.

iOS forensic tool.

IOS Backup Analyzer.

Allows you to forensically examine or recover date from in iOS device.

Remotely dump RAM of a Linux client and create a volatility profile for later analysis on your local host.

A small, non-interactive utility that scans mail folders for messages matching regular expressions. It does matching…

An open-source forensic framework written in Python/GTK that manages cases and case items, providing an abstract…

Network Appliance Forensic Toolkit. Networkminer A Network Forensic Analysis Tool for advanced Network Traffic…

A tool for extracting files from the network in real-time or post-capture from an offline tcpdump pcap savefile.

[windows]: Active Directory forensic framework.

Examines the contents of Internet Explorer's cache files for forensic purposes. |

Network Forensics Tool - To visualize a Packet Capture offline as a Network Diagram including device identification,…

Forensic tool to replay web-based attacks (and also general HTTP traffic) that were captured in a pcap file.

Utility for facebook memory forensics.

A tool aimed at analyzing PDF documents.

A Python tool to explore PDF files in order to find out if the file can be harmful or not.

Command line based tool for PE32/PE32+ file analysis.

Memory Forensic Framework.

A tool for forensic file system reconstruction.

A rewrite of rifiuti, a great tool from Foundstone folks for analyzing Windows Recycle Bin INFO2 file.

Checks machines for the presence of rootkits and other unwanted tools.

A library and collection of command line digital forensics tools that allow you to investigate volume and file system…

A tool used to automate Linux swap analysis during post-exploitation or forensics.

A forensics tool to examine Thumbs.db files.

macOS Memory Analysis Toolkit.

Advanced memory forensics framework.

Internet Traffic Decoder. Network Forensic Analysis Tool (NFAT).

Reader and rewriter of EXIF informations that supports raw files.

Exif, Iptc and XMP metadata manipulation library and tools.

Timestomper and Timestamp checker with nanosecond accuracy for NTFS volumes.

An open source data carving tool.

Manipulate timestamps on NTFS.

Execute ELFs in memory.

A forensic tool to find processes hidden by rootkits, LKMs or by other techniques.

File-less persistence, attacks and anti-forensic capabilities (Windows 7 32-bit).

Inject code into running processes with ptrace().

ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection).

System cleaner for Windows and Linux.

ChainSaw automates the process of shredding log files and bash history from a system. It is a tool that cleans up the…

Powershell Command. Clears all entries from specified event logs on the local or remote computers.

Darik's Boot and Nuke ("DBAN") is a self-contained boot image that securely wipes the hard disks of most computers.…

A way to delete a locked file, or current running executable, on disk.

Anti Forensics Tool For Red Teamers, Used For Erasing Footprints In The Post Exploitation Phase.

get/set hard disk parameters.

Clear all your logs in linux/windows servers.

The meterpreter clearev command will clear the Application, System, and Security logs on a Windows system.

NTFS-3G Safe Read/Write NTFS Driver.

Network panic button designed to overwrite with random data the LUKS header of computers in a LAN.

Secure file erasing utility for macOS.

Overwrite a file to hide its contents, and optionally delete it.

An anti-forensic kill-switch that waits for a change on your usb ports and then wipes your ram, deletes precious…

Srm is a command-line compatible rm which overwrites file contents before unlinking.

A Unix tool for secure deletion.

Wipe files and drives securely with randoms ASCII dicks.

Toolkit to perform secure destruction of sensitive virtual data, temporary files and swap memories.

Offline NT Password Editor - reset passwords in a Windows NT SAM user database file.

An open source application used to retrieve lots of passwords stored on a local computer.

A tool to dump the login password from the current linux user.

ELF encryption program.

Utility used to conveniently set up disk encryption based on the DMCrypt kernel module.

Configure a special "nuke password" that can be used to destroy the encryption keys required to unlock the encrypted…

ELF crypter.

A free "on-the-fly" transparent disk encryption program for PC & PDAs.

Midgetpack is a multiplatform secure ELF packer.

Decentralized opsec panic button operating over UDP broadcasts and HTTP. Provides automatic ejection of encrypted…

Universal script packer-- transforms any type of script into a protected ELF executable, encrypted with anti-debugging.

A toolset for creating cryptographically strong volumes that destroy themselves upon tampering (event) or via issued…

Reveal encrypted files stored on a filesystem.

Detect TrueCrypt containers using a fast and memory efficient approach.

Displays information about and performs functions to manipulate audit policies in Windows.

Fix acquired .evt - Windows Event Log files (Forensics) [windows]

A collection of scripts built for reading Windows® NT/2K/XP/2K eventlog files. [windows]

Recover event log entries from an image by heurisitically looking for record structures.

A tool to parse the Windows XML Event Log (EVTX) format.

Software framework for implementing USB device authorization policies (what kind of USB devices are authorized) as…

Enables you to create and manage subscriptions to events that are forwarded from remote computers. The remote computer…

Enables you to retrieve information about event logs and publishers. You can also use this command to install and…

Hides text or files inside audio files and retrieve them automatically.

Steganography in chess games.

Transforms any filetype into a list of harmless-looking strings. This lets you hide the file in plain sight, and…

jsteg is a package for hiding data inside jpeg files.

A tool aimed at analyzing and capturing data that is hidden between frames in an MP3 file or stream, otherwise noted…

Stealthily exfiltrate data and defeat attribution using DNS queries and text-based steganography.

Format-agnostic steganographic tool for x86 and AMD64 binaries. You can use it to hide information in compiled…

Simple C++ Image Steganography tool to encrypt and hide files insde images using Least-Significant-Bit encoding.

Least Significant Bit Steganography for bitmap images (.bmp and .png), WAV sound files, and byte sequences.

Invisible Hyperlinks in Physical Photographs.

Hide secrets with invisible characters in plain text securely using passwords.

Automated tool for detecting steganographic content in images.

A FUSE based steganographic file system.

Steganography program that is able to hide data in various kinds of image- and audio-files.

Go tool for LSB steganography, capable of hiding any file within an image.

stego is a steganographic swiss army knife.

A tool for creating steganographic images using adversarial training.

This project is a Docker image useful for solving Steganography challenges as those you can find at CTF platforms.

Yet another Stego Tool.

Pack up to 3MB of data into a tweetable PNG polyglot file.

A tool for the automatic analyze of malware behavior.

Submits a file's SHA1 sum to VirusTotal to determine whether it is a known piece of malware.

Use any desktop OS without leaving a trace.

portable operating system that protects against surveillance and censorship.

BusKill is an hardware and software project that uses a hardware tripwire/dead-man-switch to trigger a computer to…

Hide-My-Windows Laser Tripwire.

Security tool for macOS that aims to detect unauthorized physical access to your laptop.

An anti-forensic kill-switch that waits for a change on your usb ports and then wipes your ram, deletes precious…

Anti-forensic kill-switch that waits for a change on your USB ports and then immediately shuts down your computer.

Anti-forensic tool that writes udev rules for known usb devices and do some things at unknown usb insertion or…

Windows anti-forensics USB monitoring tool.

A proof-of-concept Android application to detect and defeat some of the Cellebrite UFED forensic toolkit extraction…

A "panic button" app for triggering a "ripple effect" across apps that are set up to respond to panic events.