Dshell: An Extensible Network Forensic Analysis Framework
Dshell is an extensible network forensic analysis framework, that enables rapid development of plugins to support the dissec…
Forensic Review with Notepad++
In this post Hoyt Harness writes about how to add Plugin Manager to Notepad++ and make it very extensible and useful for dig…
Make Your Debian a Forensic Workstation
If you are looking for a SIFT replacement and already have a Debian workstation, this package is for you. Forensics-full pac…
Autopsy 4.6.0 Linux Beta 1
The first beta Linux version of your favourite open source DFIR tool Autopsy. You can download it here. Now the tool has the…
The Sleuth Kit and Autopsy 4.6.0 have been released
The Sleuth Kit and Autopsy 4.6.0 are available for downloading. Here are the lists of new features: The Sleuth Kit New Commu…
Incident Response Tools
In this post Harlan Carvey has presented his views on incident response tools. In the post you’ll find both “cla…
Carve and recreate VSS catalog with vss_carver
Minoru Kobayashi has presented a tool for carving and recreating deleted VSS at at Japan Security Analyst Conference 2018. T…
Carving Fragmented Registry Files
Yet another registry parser, or yarp, is a library and tools to deal with Windows registry files [1]. Despite the name, yarp…
How to Mount Mac APFS Images in Windows
In the first post of the new year Mari Degrazia is writing about mounting APFS images in Windows. The thing is, Paragon has …
Incident Response Script for APT Hunting
Sergey Golovanov and Igor Soumenkov have prepared a New Year present for DFIR community: they have presented their script fo…
