#dfir

DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI

Build AI-powered security tools. 50+ hands-on labs covering ML, LLMs, RAG, threat detection, DFIR, and red teaming. Includes Colab notebooks, Docker environment, and CTF challenges.

g(ULP) core backend and plugins

Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images

Decrypt and explore UniFi backup files (.unf/.unifi) entirely offline — extract, decode the MongoDB dump, export sites

Rapidly Search and Hunt through Windows Forensic Artefacts

Rapidly Search and Hunt through Windows Forensic Artefacts

Forensics artefact collection tool for systems running Microsoft Windows

Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileSystemOpen — with recursive PathSpec locators. The contract crate every fleet reader implements.

Open-source, offline forensic scanner CLI tool designed to detect evidence of git repo collection or upload by the Grok Build CLI to xAI infrastructure.

Console-IR. OCSF-native incident response and investigation TUI for the terminal. Triage findings, pivot on indicators, investigate hosts and accounts, GeoIP and WHOIS enrichment, case management, write the report. Single Go binary, SQLite, no server. Open Cybersecurity Schema Framework security tooling for SOC analysts and DFIR.

Open source log management, detection, and collaboration