Computer Forensic Reference DataSet Portal – This portal is your gateway to documented digital forensic image datasets. These datasets can assist in a variety of tasks including tool testing, developing familiarity with tool behavior for given tasks, general practitioner training and other unforeseen uses that the user of the datasets can devise. Most datasets have a description of the type and locations of significant artifacts present in the dataset. There are descriptions and finding aides to help you locate datasets by the year produced, by author, or by attributes of the dataset.
Acquire– Acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container
artifactcollector– A customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
ArtifactExtractor– Extract common Windows artifacts from source images and VSCs
AVML– A portable volatile memory acquisition tool for Linux
SPECTR3– Acquire, triage and investigate remote evidence via portable iSCSI readonly access
unix_collector– A live forensic collection script for UNIX-like systems as a single script.
Velociraptor– Velociraptor is a tool for collecting host based state information using Velocidex Query Language (VQL) queries
WinTriage– Wintriage is a live response tool that extracts Windows artifacts. It must be executed with local or domain administrator privileges and recommended to be done from an external drive.
⭐Guymager– Open source version for disk imageing on linux systems
Docker ExplorerExtracts and interprets forensic artifacts from disk images of Docker Host systems
FRED– Cross-platform microsoft registry hive editor
Hayabusa– A a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
LastActivityView– LastActivityView by Nirsoftis a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer.
LogonTracer– Investigate malicious Windows logon by visualizing and analyzing Windows event log
PyShadow– A library for Windows to read shadow copies, delete shadow copies, create symbolic links to shadow copies, and create shadow copies
python-evt– Pure Python parser for classic Windows Event Log files (.evt)
RegRipper3.0– RegRipper is an open source Perl tool for parsing the Registry and presenting it for analysis
RegRippy– A framework for reading and extracting useful forensics data from Windows registry hives
Disk Arbitrator– A Mac OS X forensic utility designed to help the user ensure correct forensic procedures are followed during imaging of a disk device
imagemounter– Command line utility and Python package to ease the (un)mounting of forensic disk images
libewf– Libewf is a library and some tools to access the Expert Witness Compression Format (EWF, E01)
PancakeViewer– Disk image viewer based in dfvfs, similar to the FTK Imager viewer
xmount– Convert between different disk image forma
MFTMactime– MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.
Dissect– Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).
hashlookup-forensic-analyser– A tool to analyse files from a forensic acquisition to find known/unknown hashes fromhashlookupAPI or using a local Bloom filter.
IntelMQ– IntelMQ collects and processes security feeds
Squey– Logs/PCAP visualization software designed to detect anomalies and weak signals in large amounts of data.
Catalyst – Catalyst is an open source security automation and ticket system
dfirtrack – Digital Forensics and Incident Response Tracking application, track systems
Incidents – Web application for organizing non-trivial security investigations. Built on the idea that incidents are trees of tickets, where some tickets are leads
iOS Frequent Locations Dumper– Dump the contents of the StateModel#.archive files located in /private/var/mobile/Library/Caches/com.apple.routined/
MEAT– Perform different kinds of acquisitions on iOS devices
MobSF– An automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
ChromeCacheView– A small utility that reads the cache folder of Google Chrome Web browser, and displays the list of all files currently stored in the cache
chrome-url-dumper– Dump all local stored infromation collected by Chrome
hindsight– Internet history forensics for Google Chrome/Chromium
IE10Analyzer– This tool can parse normal records and recover deleted records in WebCacheV01.dat.
bulk_extractor– Extracts information such as email addresses, creditcard numbers and histrograms from disk images
floss– Static analysis tool to automatically deobfuscate strings from malware binaries
swap_digger– A bash script used to automate Linux swap analysis, automating swap extraction and searches for Linux user credentials, Web form credentials, Web form emails, etc.
NetWire Log Decoder – NetWire Log Decoder is an AutoIt tool that carves and parses (a/k/a scans, filters, and decodes) NetWire log data from files or devices. NetWire versions 1.6 and 1.7, on Windows and Linux, have been tested.
GRR– GRR Rapid Response: remote live forensics for incident response
Linux Expl0rer– Easy-to-use live forensics toolbox for Linux endpoints written in Python & Flask
mig– Distributed & real time digital forensics at the speed of the cloud
POFR– The Penguin OS Flight Recorder collects, stores and organizes for further analysis process execution, file access and network/socket endpoint data from the Linux Operating System.
UAC– UAC (Unix-like Artifacts Collector) is a Live Response collection script for Incident Response that makes use of native binaries and tools to automate the collection of AIX, Android, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris systems artifacts.
APFS Fuse– A read-only FUSE driver for the new Apple File System
