Dfir Python Packages

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

filegrail

Trace file provenance, metadata, telemetry, investigative pivots and relationships across files, browser history, OS traces and archives. Local, read-only, no network requests.

cortexutils

Cortex Analyzers Repository

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

pyhindsight

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

torikago

Torikago (鳥籠) — static triage for an unknown executable. Identifies, unpacks and reports indicators, and never runs the target.

unmasker

Detect hidden, residual, and machine-readable content in documents, images, and files.

reg2es

A command-line tool for parsing Windows NT Registry(REGF format) and importing the results into Elasticsearch.

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

ventra

Cloud forensic triage for AWS, Azure, GCP and Kubernetes

netforensicai

Local-first, open-source DFIR investigation platform. Correlates pcap, JSON/CSV and Windows EVTX/Sysmon evidence into one traceable timeline, entity graph and evidence-cited findings - with offline detection rules, MITRE ATT&CK mapping, a local web UI, live capture, and an optional AI assistant that cannot fabricate citations.

ntfsdump

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

talus-process-monitor

eBPF ransomware detection & response agent for Linux — single static binary, no kernel modules, behavioural scoring, process pause/kill

mulder-dfir

Agentic DFIR

threatingestor

Extract and aggregate threat intelligence.

ntfsfind

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

polars-iptools

Polars extension for IP address parsing and enrichment including geolocation

gokdogan-triage

Static PE malware triage engine — imphash/entropy/packer/strings/capabilities/YARA + MITRE ATT&CK, weighted verdict. No sample execution, offline core.

office-password-toolkit

Detect, extract, bypass, and decrypt passwords and protection in Microsoft Office and OpenDocument files

cortex4py

Python API Client for Cortex

turbinia

Automation and Scaling of Digital Forensics Tools

sys-inspector

eBPF-based forensic and security inspection for Linux: live process tree, persistence enumeration and normalized findings mapped to MITRE ATT&CK, in self-contained encrypted reports. https://build.opensuse.org/project/show/home:mariosergiosl:sys-inspector

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

dfir

DFIR 资料汇总 - 数字取证与事件响应