Linux Evidence Acquisition Framework
-
Updated
Sep 30, 2024 - Python
#
linux-forensics
Here are 46 public repositories matching this topic...
Hello, world! 🌍 I'm a passionate Linux System & Server Administrator, living in front of three tty terminals 🖥 🖥 🖥, where I breathe Linux and script bash every day. With a burning desire to master the command line, I dive deep into the file system. As a content creator on YouTube, I share my journey and knowledge with fellow linux enthusiasts!
android linux bash docker osint ubuntu hacking kali-linux bash-scripting mullvad linux-forensics alfa-adapters
-
Updated
Jun 12, 2026
Lateral movement tracker for anything: Windows, Linux and macOS logs, forensic images (E01, VMDK, VHDX; no mounting) and triage packages into one timeline, with a statistical hunt and a graph viewer. One Rust binary for Windows, Linux and macOS.
rust ssh timeline incident-response dfir rdp graph-visualization digital-forensics vmdk anomaly-detection blue-team e01 evtx windows-event-logs kape lateral-movement velociraptor linux-forensics macos-forensics forensic-images
-
Updated
Nov 13, 2026 - Rust
Unified digital forensics platform bringing disk, RAM, container drift, logical acquisition, and backup analysis together for Windows, Linux, Docker, Android, and iOS.
android windows ios forensics forensic-analysis forensic forensic-tools forensics-tools docker-forensics linux-forensics digitalforensic ios-forensics android-forensics forensic-tool android-forensics-tool forensic-imageing iphone-forensic
-
Updated
Oct 10, 2026
Hands-on projects for beginners to learn and practice Linux forensics and essential cybersecurity skills
-
Updated
Jun 29, 2024
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
-
Updated
Nov 4, 2026 - Rust
Collect-LinuxMemoryDump - Linux Memory Acquisition for Digital Forensics and Incident Response (DFIR)
linux incident-response dfir digital-forensics memory-forensics forensic-tools live-response memory-acquisition linux-forensics dfir-tools
-
Updated
Oct 12, 2026 - Shell
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
rust incident-response dfir threat-hunting malware-analysis digital-forensics memory-analysis yara volatility lime ld-preload memory-forensics dpapi windows-forensics linux-forensics avml rootkit-detection ioc-detection elf-analysis
-
Updated
Nov 4, 2026 - Rust
Tools and Techniques for Digital Forensics and Incident Response
incident-response dfir digital-forensics digital-forensics-incident-response windows-forensics linux-forensics
-
Updated
Oct 2, 2026
Practical labs, case studies, and investigation notes for CHFI v11 — covering digital forensics, malware forensics, incident response, evidence collection, and analysis tools.
network-forensics data-acquisition digital-forensics computer-forensics memory-forensics mobile-forensics evidence-collection windows-forensics disk-forensics cyber-forensics linux-forensics malware-forensics chfi cyber-investigation cybercrime-investigation log-anaysis forensics-analysis
-
Updated
Aug 31, 2025
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara triage memory-forensics mitre-attack lolbins kape velociraptor windows-forensics linux-forensics macos-forensics forensic-artifacts
-
Updated
Nov 12, 2026 - Rust
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Oct 20, 2026 - Python
Useful tools for (not only) digital forensics
network-forensics incident-response digital-forensics memory-forensics mobile-forensics windows-forensics linux-forensics macos-forensics ios-forensics live-forensics android-forensics mobile-forensic webbrowsers-forensics
-
Updated
Jul 21, 2026
FortiSOAR & FortiGate VM Adli Bütünlük, Lisans Baypas (Crack) ve Tedarik Zinciri Denetim Platformu — 19 Çekirdek + 3 OVA Motoru, Yapısal Değişmez Temelli (Düşük Yanlış Pozitif), RFC 6962 Merkle Kanıt Mührü
rust incident-response reverse-engineering forensics dfir cybersecurity merkle-tree fortigate soar supply-chain-security linux-forensics fortisoar
-
Updated
Nov 7, 2026 - Rust
Kokino Forensic Toolkit (Kokino FTK): open-source disk forensics in your browser. E01, raw, VHD(X), VMDK, ISO; NTFS, FAT, exFAT, ext2/3/4, HFS+, APFS, ISO 9660, UDF; BitLocker, shadow copies, triage collections (KAPE, Velociraptor, UAC). Windows, macOS and Linux artifacts, browsers, email (Outlook PST/OST, mbox, Apple Mail), carving, correlation.
rust security ext4 incident-response forensics dfir fat ntfs exfat digital-forensics iso9660 vmdk vhdx apfs e01 browser-forensics windows-forensics linux-forensics hfs-plus registry-forensics
-
Updated
Nov 12, 2026 - Rust
Hello, world! 🌍 I'm a passionate Linux System & Server Administrator, living in front of three tty terminals 🖥 🖥 🖥, where I breathe Linux and script bash every day. With a burning desire to master the command line, I dive deep into the file system. As a content creator on YouTube, I share my journey and knowledge with fellow linux enthusiasts!
android linux bash docker osint ubuntu hacking kali-linux bash-scripting mullvad linux-forensics alfa-adapters
-
Updated
Apr 4, 2025
Evidence-preserving digital forensics primitives and composable workflows for analysts, automation systems, and autonomous agents.
python cli security toolkit network-forensics incident-response forensics dfir digital-forensics windows-forensics linux-forensics android-forensics agent-tools
-
Updated
Oct 28, 2026 - Python
Home lab for Linux endpoint forensics using GRR Rapid Response, covering server setup, agent deployment, live forensics, memory analysis, and persistence detection.
-
Updated
Jul 24, 2024
A memory forensics automation tool that wraps Volatility 3, runs plugins, detects suspicious activity (malicious processes, code injection, network anomalies), and generates professional reports from a single command. Supports Windows, Linux, and macOS.
automation incident-response dfir cybersecurity threat-hunting malware-analysis digital-forensics volatility forensic-analysis memory-forensics security-tools malware-detection blue-team threat-detection soc-tools volatility3 windows-forensics linux-forensics python-forensics
-
Updated
Aug 18, 2026 - Python
Complete notes, lab writeups, and challenge walkthroughs for the LetsDefend Incident Responder Path. This covers DFIR, memory forensics, Windows Event Log analysis, Active Directory attack hunting, malware triage and more!
log-analysis incident-response active-directory dfir sysmon malware-analysis volatility memory-forensics kerberoasting browser-forensics windows-forensics linux-forensics soc-analyst letsdefend forensic-aquisition
-
Updated
Aug 11, 2026
Add this topic to your repo
To associate your repository with the linux-forensics topic, visit your repo's landing page and select "manage topics."