Hands-on projects for beginners to learn and practice Windows forensics and essential cybersecurity skills
-
Updated
Jun 29, 2024
#
windows-forensics
Here are 125 public repositories matching this topic...
Open-source digital forensics (DFIR) toolkit with a desktop GUI: analyse E01, AFF4, raw/dd and VMDK disk images, recover deleted files by file carving, build timelines, search evidence and run YARA/Sigma rules. Windows, macOS, Linux.
incident-response forensics dfir cybersecurity ntfs digital-forensics windows-registry yara file-recovery blue-team e01 file-carving forensics-investigations forensic-tools pyside6 windows-forensics disk-forensics forensics-tools digitalforensic dfir-tools
-
Updated
Oct 19, 2026 - Python
Cross-platform registry browser for raw Windows registry files
-
Updated
Apr 15, 2023 - Python
Windows forensics Engine
registry logs prefetch forensics mru ai-agents mft usn srum windows-forensics forensics-tools forensics-data identity-engine ai-forensics crow-eye shell-items shellbags
-
Updated
Oct 10, 2026 - Python
ExeSpy is a cross-platform PE viewer for EXE and DLL files
-
Updated
Feb 19, 2025 - Python
Vault of Windows Registry forensic artifacts
-
Updated
Nov 12, 2025 - JavaScript
A comprehensive MCP server for Windows digital forensics on KALI Linux
-
Updated
Sep 29, 2026 - YARA
Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.
rust neo4j vss incident-response dfir graph-database event-log threat-hunting digital-forensics cypher ual evtx kape lateral-movement velociraptor memgraph digital-forensics-incident-response windows-forensics digital-forensic-tool forensic-tool
-
Updated
Oct 14, 2026 - Rust
A DFIR Incident Response AI bot using local Ollama LLM to derrive automated findings from logs
incident-response dfir digital-forensics triage live-response windows-forensics forensics-tools llm ollama dfirvault ir-tools dfir-ai dfir-llm
-
Updated
Jan 17, 2026 - Python
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
rust incident-response dfir threat-hunting malware-analysis digital-forensics memory-analysis yara volatility lime ld-preload memory-forensics dpapi windows-forensics linux-forensics avml rootkit-detection ioc-detection elf-analysis
-
Updated
Aug 20, 2026 - Rust
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
-
Updated
Aug 17, 2026 - Rust
Tools and Techniques for Digital Forensics and Incident Response
incident-response dfir digital-forensics digital-forensics-incident-response windows-forensics linux-forensics
-
Updated
Oct 2, 2026
Search Windows forensic artifacts, see where each one lives on disk, and copy the KAPE command to collect it. Also builds collection scripts and converts Sigma rules in the browser.
incident-response forensics artifacts digital-forensics forensic-analysis artefacts forensics-investigations windows-forensics forensics-tools
-
Updated
Oct 20, 2026 - TypeScript
Command Spy is a utility for monitoring the command line arguments of new processes on Windows. Made for CCDC.
-
Updated
Jul 30, 2023 - C#
Valhuntir Windows forensic tool execution via MCP
-
Updated
Oct 17, 2026 - Python
Forensic analyzer for Windows WebCacheV01.dat. Reads dirty ESE databases read-only, recovers deleted records from free pages and transaction logs, and exports court-ready reports (PDF, Excel, CSV, JSON, SQLite, offline HTML) with SHA-256 provenance.
-
Updated
Oct 19, 2026 - Python
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Jan 21, 2026
Python module for forensic analysis of Windows shortcuts (LNK files). You can install this package using pip install lnkanalyser
-
Updated
Mar 28, 2024 - Python
Useful tools for (not only) digital forensics
network-forensics incident-response digital-forensics memory-forensics mobile-forensics windows-forensics linux-forensics macos-forensics ios-forensics live-forensics android-forensics mobile-forensic webbrowsers-forensics
-
Updated
Jul 21, 2026
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara triage memory-forensics mitre-attack lolbins kape velociraptor windows-forensics linux-forensics macos-forensics forensic-artifacts
-
Updated
Oct 20, 2026 - Rust
Add this topic to your repo
To associate your repository with the windows-forensics topic, visit your repo's landing page and select "manage topics."