Popular repositories Loading
-
usnjrnl-forensic
usnjrnl-forensic Public archiveThe most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery, anti-forensics detection, timestomp…
Rust 31
Repositories
- timeglyph Public
Decode, identify & encode forensic timestamps — every reading ranked, scored, and cited — plus a timezone/DST/leap-aware reference calendar for interpreting them (DST folds, leap seconds, GPS week, format epochs, moon phase). Rust CLI + library, WASM playground, and a live hover-to-decode overlay.
- forensicnomicon Public
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
- browser-forensic Public
Parse Chrome/Firefox/Safari and embedded-Chromium app artifacts — history, cookies, web storage, integrity/tampering, free-page carving, container discovery — into one JSON timeline. Single static Rust binary, no runtime deps.
- lzvn Public
Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).
- forensic-hashdb Public
File hash databases for digital forensics — NSRL/CIRCL known-good, malware known-bad, known-vulnerable Windows drivers (loldrivers), and analyst-supplied MD5/SHA1/SHA256 feeds.
- 4n6mount Public
Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4, AD1, zip/7z/tar, LiME/AVML/crash dumps. FUSE + Dokan, ro/rw COW overlay, deleted-file browsing, NSRL filtering. Pure Rust, Apache-2.0.
- forensic-carve Public
Fleet carving contract + single-pass sweep engine: signature detection over unallocated/memory regions dispatched to per-format carvers.
- blob-decoder Public
Scored identify + decode of unknown forensic BLOBs (bplist/base64/hex/uuid/gzip/zlib/snappy), with recursive unwrap
- state-history-forensic Public
State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No deps, no I/O.
- safe-decode Public
Panic-free, allocating byte-to-value transforms with no format knowledge: ROT13, the UTF-16 decoder family with its NUL policy named in each function, and hex rendering.
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…