forensictools Goto Github PK

albinohatbreakme

andersonetal-skypeanalyzer

Tool to analyze Skype communications

antifuzzyhashing-475-2161_keenan_frank

Fuzzy hashing provides a comparison of two files whose content may only vary slightly. Tools that provide such a service, like ssdeep or VirusTotal, are very helpful to forensic investigators as they can aid in finding potentially incriminating files. However, an individual may wish to protect files from discovery by these techniques. This Windows command line utility will aim to serve as an anti-fuzzy hashing tool. The tool will take an input file (e.g. mp3) and perform a fuzzy hashing function , will make small changes intended to will result in the second fuzzy hashes being materially different from the source.

arm-anti-forensic-redundant-malware-csec475-2171-bartelmo-botschagow-suter

artifacts

Digital Forensics Artifact Repository

bad-date

This tool detects timestomping by analyzing the MAC timestampts

bassethound

A Linux kernel module and userland utility pair to detect processes hidden by Linux kernel module (LKM) rootkits.

bintracker-csec475-2171-dayal-procario-sheldon

binview

CSEC 467 Forensic Project

bitcollector-475-2151_thoresen

open source data collection tool

bithash_474-2135_herting

BitHash takes advantage of the ".torrent" file format - specifically the "pieces" field in the file

browserhistoryanalyzer-475-2161_anthony_schade

This tool will pull, analyze, and display browser history from different browsers in an easy to read format. It will integrate a simple interactive map using templates from d3js.org. It will sort and visually produce output based on various factors such as website name or time. Plans are in place to integrate a search feature that would take in a website name and return information on said website (ie. Was it accessed? When? How many times?). Time permitting, the program might highlight malicious or illegal searches and websites based on user input.

browsertimelinerecovery-kaminski-rhodes

Attempts to recover deleted browsing history based on browsing data such as cookies, cache, etc.

btcompare_-475-2151_herting

.torrent files contain hashes of every n-sized block of data they describe. This tool will be used to compare multiple .torrent files in order to determine what blocks are different between two different sets of data, and potentially what files might be differen t.

bulk_extractor

This is the development tree. For downloads please see:

chizel-475-2151_patulski_sigman

Chizel is a cloud storage interagtor.  It streamlines the process of collecting data from the cloud and presenting it in a clear manner.

chronos-watcher-464_2131-messinger_ionescu

computer-forensics-project

VERITAS

crowdstrike_falcon_orchestrator-csec475-2171-adler-martin-myers

csf_project

cuttr_474-2135_cooper-hasselstrom

Extensible Forensic Framework

datavisualizer-475-2161_whitcroft

This tool is used to visualize forensic data, specifically web data and file analysis data. The data will be easily visualized and searchable through different filter options {dates, frequency, user, etc}.

dfir_-jcc6228-_csec464

Github repository for CSEC 464

digiforensics-464_2131-coffie

USB tool for memory imaging

dirtymemory_474-2135_-eftychiou

A tool to search the memory for strings and patterns with suspicious, illegal or immoral connotation. Searches memory for words and patterns based on past and current news of illegal activities or threats. Finding matches, it will analyze and provide a clear and readable summary to the user.

doorstop

PCAP analysis for finding reverse https backdoors

exerunnerpro-475-2151_bush_garbutt_reynolds

This tool will gather a list on a Windows machine of what programs were run and when they were ran.

extractbrowserhistoryplusextensions-475_2141-alacritas-raber-pitkin

This is a java-based tool to extract web browsing history and extensions and display in a variety of formats - both raw data and visual.

ezmount

Forensics Tool Project

file-carver

Tool to carve files and paritions from image files using sleuthkit