Dfir Python Packages

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

cortexutils

Cortex Analyzers Repository

pyhindsight

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

threatingestor

Extract and aggregate threat intelligence.

cortex4py

Python API Client for Cortex

bayyinah

File integrity scanner detecting hidden, concealed, or adversarial content across 23 file kinds. Input-layer application of the Munafiq Protocol

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

turbinia

Automation and Scaling of Digital Forensics Tools

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

polars-iptools

Polars extension for IP address parsing and enrichment including geolocation

turbinia-api-lib

Automation and Scaling of Digital Forensics Tools

turbinia-client

Automation and Scaling of Digital Forensics Tools

rekos

Terminal-native passive OSINT CLI for local-first public-source investigation workspaces

generaptor

CLI generator for Velociraptor offline collector

flow-transport

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

flow-ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

edf-helium-core

Collaborative Forensic Collections Manager

ntfsdump

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

edf-helium-server

Collaborative Forensic Collections Manager

loghunter-cli

Local-first, transparent threat hunting for the logs you already have: Zeek, Pi-hole, syslog, CloudTrail. Names the technique behind every finding. No SIEM, no agent, no black box.

edf-helium-client

Collaborative Forensic Collections Manager

ntfsfind

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

edf-plasma-dissectors

Extract and normalize information from forensics artifacts