forensics

Rapidly Search and Hunt through Windows Forensic Artefacts

Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.

operative framework is a rust investigation OSINT framework, you can interact with multiple targets, execute multiple modules, create links with target, export rapport to PDF file, add note to target or results, interact with RESTFul API, write your own modules.

Detects process injection and memory manipulation used by malware. Finds RWX regions, shellcode patterns, API hooks, thread hijacking, and process hollowing. Built in Rust for speed. Includes CLI and TUI interfaces.

A cross platform parser for Apple UnifiedLogs!

CLI tools for forensic investigation of Windows artifacts

Suzaku (朱雀) is a sigma-based threat hunting and fast forensics timeline generator for cloud logs.

Fast Vim-inspired hex editor for the terminal

Zero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.

ELEGANTBOUNCER is a detection tool for file-based mobile exploits.

Wipe files and drives securely with random ASCII dicks

Search Index Database Reporter

Find multi-byte-encoded strings in binary data (Gitlab mirror).

A small util to brute-force prefetch hashes

面向取证的节点式可视化工作台 —— 像 ComfyUI 一样搭工作流，专为编码解密、隐写取证、图像分析、密码学而生。

RAIR: RAdare In Rust

Hunt down social media accounts by username across social networks

Ultra-fast file search for Windows using NTFS MFT

Forensic tool to read all installed packages from a mounted Arch Linux drive and compare the filesystem to a trusted source

Forensic framework to build tools that can be reused in multiple projects without changing anything