Custom DFIR

• yarp

  1 123 10.0 Python

  Yet another registry parser (by msuhanov)

Use yarp. It includes a module to access hives on a live system.

• srum-dump

  4 573 3.9 Python

  A forensics tool to convert the data in the Windows srum (System Resource Usage Monitor) database to an xlsx spreadsheet.

FGET can get the locked files for you. https://github.com/MarkBaggett/srum-dump/blob/master/FGET.exe

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• velociraptor

  5 2,683 9.6 Go

  Digging Deeper....

  

However, what you are trying to do has already been done. For collections look at velociraptor's offline collector https://github.com/Velocidex/velociraptor. For processing check out Log2Timeline (plaso) https://github.com/log2timeline/plaso.

• plaso

  3 1,624 9.0 Python

  Super timeline all the things

  

However, what you are trying to do has already been done. For collections look at velociraptor's offline collector https://github.com/Velocidex/velociraptor. For processing check out Log2Timeline (plaso) https://github.com/log2timeline/plaso.

• timesketch

  2 2,496 9.0 Python

  Collaborative forensic timeline analysis

  

Want to put those processed plaso files in an elasticsearch instance check out Timesketch - https://github.com/google/timesketch.

• SaaSHub

  www.saashub.com featured

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Suggest a related project