PyPI · npm
prowler-cloud/prowler
Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.
Apache-2.0Aug 27, 2026 · metrics 2.10.0
All tags
Catalogue tag
#forensics
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
35 records
PyPI
mvt-project/mvt
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Custom licenseSep 19, 2026 · metrics 2.10.0
crates.io · Go · npm +1
VirusTotal/yara-x
A rewrite of YARA in Rust.
BSD-3-ClauseOct 22, 2026 · metrics 2.10.0
PyPI
sherlock-project/sherlock
Hunt down social media accounts by username across social networks
MITSep 16, 2026 · metrics 2.10.0
PyPI · crates.io
mkorman90/regipy
Regipy is an os independent python library for parsing offline registry hives
MITOct 12, 2026 · metrics 2.10.0
crates.io · PyPI
Yamato-Security/hayabusa
Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
AGPL-3.0Oct 12, 2026 · metrics 2.10.0
PyPI
wagga40/Zircolite
A standalone SIGMA-based detection tool for EVTX, Auditd and Sysmon for Linux logs
Custom licenseOct 19, 2026 · metrics 2.10.0
PyPI
SpamScope/mail-parser
A tool that parses emails by enhancing the Python standard library, extracting all details into a comprehensive object.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
crates.io
mandiant/macos-UnifiedLogs
A cross platform parser for Apple UnifiedLogs!
Apache-2.0Sep 15, 2026 · metrics 2.10.0
crates.io
SecurityRonin/forensicnomicon
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
attenlabs/hotato
Find what broke in your agent calls. Pin it so it never ships again. Local voice-agent call forensics and regression guards.
MITOct 20, 2026 · metrics 2.10.0
Go
L1ghtn1ng/traceguard
TraceGuard uses the eBPF subsystem of the linux kernel to get valuable insights to what your system is doing
MITOct 21, 2026 · metrics 2.10.0
crates.io
SecurityRonin/ewf-forensic
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
Apache-2.0Sep 18, 2026 · metrics 2.10.0
Go
EvilBit-Labs/unifi_extract
Decrypt and explore UniFi backup files (.unf/.unifi) entirely offline — extract, decode the MongoDB dump, export sites
Apache-2.0Sep 14, 2026 · metrics 2.10.0
crates.io
SecurityRonin/lzo
GPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies, and #![forbid(unsafe_code)]; validated against liblzo2 and fuzz-hardened against malicious input.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
crates.io
WithSecureLabs/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
GPL-3.0Sep 10, 2026 · metrics 2.10.0
crates.io
WithSecureOpenSource/chainsaw
Rapidly Search and Hunt through Windows Forensic Artefacts
GPL-3.0Oct 18, 2026 · metrics 2.10.0
crates.io
SecurityRonin/forensic-vfs
Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.
Apache-2.0Sep 17, 2026 · metrics 2.10.0
PyPI
hed0rah/acidcat
Binary analysis and reverse-engineering for audio file formats and music-production hardware
MITSep 10, 2026 · metrics 2.10.0
Go
optimuslabs-io/grokpatrol
Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.
Apache-2.0Sep 11, 2026 · metrics 2.10.0
PyPI
osintshifu/filegrail
Trace file provenance, metadata, telemetry, investigative pivots and relationships across files, browser history, OS traces and archives. Local, read-only, no network requests.
Apache-2.0Sep 19, 2026 · metrics 2.10.0
PyPI
ydkhatri/mac_apt
macOS (& ios) Artifact Parsing Tool
MITSep 15, 2026 · metrics 2.10.0
crates.io
SecurityRonin/state-history-forensic
State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No deps, no I/O.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
6abd/horus
An OSINT / digital forensics tool built in Python
GPL-3.0Sep 8, 2026 · metrics 2.10.0
npm
whisper-sec/whisper-graph-mcp
Open-source MCP server for WhisperGraph — query the internet's infrastructure & threat-intel graph (DNS, BGP, GeoIP, WHOIS) via Cypher.
Apache-2.0Sep 18, 2026 · metrics 2.10.0
Go
philcantcode/go-forensic-artifacts
Local-first Go library for immutable forensic evidence, provenance, and reproducible artifacts.
MITOct 20, 2026 · metrics 2.10.0
Go
aoiflux/libntfs
LIBNTFS is a Go library for parsing NTFS. The library is designed following industry best practices and informed by the reference implementation from The Sleuth Kit (TSK).
MITOct 18, 2026 · metrics 2.10.0
crates.io
SecurityRonin/safe-read
Panic-free bounded integer readers over untrusted byte slices (no_std, no deps)
Apache-2.0Sep 17, 2026 · metrics 2.10.0
crates.io
ankit-chaubey/Archivum
Deterministic TAR-based backups with per-file SHA-256, Blake3-sealed index, split archives, and incremental updates
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
ridgelinecyberdefence/vanguard
Cross-platform incident response toolkit. 28 pre-built use cases in a single zero-install binary: triage, threat hunting, memory forensics, disk collection, remote operations, and Velociraptor management. Works air-gapped, with automated timeline generation.
MITSep 12, 2026 · metrics 2.10.0