#forensics

Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images

DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI

Find what broke in your agent calls. Pin it so it never ships again. Local voice-agent call forensics and regression guards.

GPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies, and #![forbid(unsafe_code)]; validated against liblzo2 and fuzz-hardened against malicious input.

Decrypt and explore UniFi backup files (.unf/.unifi) entirely offline — extract, decode the MongoDB dump, export sites

Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.

TraceGuard uses the eBPF subsystem of the linux kernel to get valuable insights to what your system is doing

Rapidly Search and Hunt through Windows Forensic Artefacts

Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.