Digital Forensics Python Packages

htmldate

Fast and robust date extraction from web pages, with Python or on the command-line

filegrail

Trace file provenance, metadata, telemetry, investigative pivots and relationships across files, browser history, OS traces and archives. Local, read-only, no network requests.

cortexutils

Cortex Analyzers Repository

ventra

Cloud forensic triage for AWS, Azure, GCP and Kubernetes

netforensicai

Local-first, open-source DFIR investigation platform. Correlates pcap, JSON/CSV and Windows EVTX/Sysmon evidence into one traceable timeline, entity graph and evidence-cited findings - with offline detection rules, MITRE ATT&CK mapping, a local web UI, live capture, and an optional AI assistant that cannot fabricate citations.

mulder-dfir

Agentic DFIR

bloodrecon

BloodRecon — 🧠 Master the art of digital hunting with 34+ OSINT modules.

dfir

DFIR 资料汇总 - 数字取证与事件响应

dftk

Evidence-preserving digital forensics primitives and composable workflows for analysts, automation systems, and autonomous agents.

framecite

Local, payload-redacted PCAP troubleshooting over MCP with deterministic packet citations—no Wireshark or TShark required.

apple-notes-forensics

Copy-first Apple Notes recovery and review toolkit for macOS, with AI-assisted triage, evidence-backed case Q&A, and a read-mostly MCP server for Codex / Claude Code style local agent workflows.

ransomtriage

Offline, privacy-preserving first-hour ransomware triage: identify the family, extract IOCs, find verified free decryptors. Nothing is uploaded.

dfdewey

dfDewey is a digital forensics string extraction, indexing, and searching tool.

pybeagle

Beagle is an incident response and digital forensics tool which transforms security logs and data into graphs.

rekos

Terminal-native passive OSINT CLI for local-first public-source investigations, evidence correlation, and case management.

slack-handler

Python tool to extract File slacks from disk images.

scrubproof

Strips metadata from 71 file formats and proves it by searching the output bytes. Your PDF scrubber is probably lying to you.

deep-recover

Recover deleted files from disk images using filesystem-metadata parsing (pytsk3) and raw signature carving. Two-engine recovery for USB drives, SD cards, and disk images — real filenames when the filesystem index survives, raw carving as fallback when it doesn't.

stegx-cli

‎StegX is a modern, open-source steganography toolkit designed for digital forensics experts and cybersecurity professionals. It offers fast, accurate, and stealthy methods by non-linear lsb algorithm to embed and extract hidden data within images outperforming traditional tools, detection evasion, and cross-format compatibility

soc-chronicle

Open-source SOC investigation engine for automated attack analysis and incident narratives.

iocx-registry-keys

High‑performance iocx plugin for detecting Windows Registry keys, values, and persistence locations. Includes full test coverage, performance benchmarks, and security checks.

stylog

Toolkit for stylometry, authorship verification, and writing-style analysis of text and source code.

recoverx

Professional CLI file recovery and file carving tool focused on raw disk analysis and forensic recovery.

save-skype

💬 Data forensics and recovery utility for Skype chats and history