easymetadata
Follow
dfir_investigations
Quick and dirty information related to Microsoft Intune analysis
Example programs used in the automating DFIR series
Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!
ALFA stands for Automated Audit Log Forensic Analysis for Google Workspace. You can use this tool to acquire all Google Workspace audit logs and to perform automated forensic analysis on the audit …
A PowerShell module for acquisition of data from Microsoft 365 and Azure for Incident Response and Cyber Security purposes.
The Business Email Compromise Guide sets out to describe 10 steps for performing a Business Email Compromise (BEC) investigation in an Office 365 environment. Each step is intended to guide the pro…
Ghidra is a software reverse engineering (SRE) framework
A SANS SIFT Docker built on Ubuntu 20.04 and 22.04 LTS
Presentation Archives for my macOS and iOS Related Research
Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox
analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.
Stand-alone parser for User Access Logging from Server 2012 and newer systems
For educational purposes only, exhaustive samples of 500+ classic/modern trojan builders including screenshots.
AWS Security Analytics Bootstrap enables customers to perform security investigations on AWS service logs by providing an Amazon Athena analysis environment that's quick to deploy, ready to use, an…
MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.
Zero-dependency Linux memory forensics, leveraging kernel-embedded BTF and kallsyms for type-aware memory analysis without external debug info.
Detect phantom IAM users, decode leaked AWS Bedrock and Claude Platform API keys, and prevent LLMjacking. CLI + SCPs + SIEM detection rules.
Runtime security monitoring for AI coding agents
EMBArk - The firmware security scanning environment