Dfir Python Packages

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

cortexutils

Cortex Analyzers Repository

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

turbinia

Automation and Scaling of Digital Forensics Tools

threatingestor

Extract and aggregate threat intelligence.

pyhindsight

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

cortex4py

Python API Client for Cortex

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

polars-iptools

Polars extension for IP address parsing and enrichment including geolocation

turbinia-api-lib

Automation and Scaling of Digital Forensics Tools

flow-ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

turbinia-client

Automation and Scaling of Digital Forensics Tools

luminaut

Casting light on shadow cloud deployments

ntfsdump

An efficient tool for extracting files, directories, and alternate data streams directly from NTFS image files.

edf-plasma-dissectors

Extract and normalize information from forensics artifacts

edf-plasma-core

Extract and normalize information from forensics artifacts

recuperabit

A tool for forensic file system reconstruction.

ipextract

Fast, inline geolocation decoration of IPv4 and IPv6 addresses written in Rust

bayyinah

File integrity scanner detecting hidden, concealed, or adversarial content across 23 file kinds. Input-layer application of the Munafiq Protocol

edf-plasma-cli

EDF Plasma CLI

maldump

Multi-quarantine extractor

ntfsfind

An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.

regrippy

A modern Python-3-based alternative to RegRipper