Forensics Tools Python Packages

htmldate

Fast and robust date extraction from web pages, with Python or on the command-line

mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

malwaredb

MalwareDB: bookkeeping for malware, goodware, and unknown files with relationship discovery

graphsense-lib

A central repository for Python utility functions and all components that interact with the GraphSense backend. The repository provides a CLI interface for managing essential GraphSense maintenance tasks and provides a REST interface used by the frontend (UI). It acts as the core repository, delivering foundational tools

reg2es

A command-line tool for parsing Windows NT Registry(REGF format) and importing the results into Elasticsearch.

ntfsdump

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

hdd-analyzer

Use Jev to quickly search your old hard drives and identify anything of value.

graphsense-python

A central repository for Python utility functions and all components that interact with the GraphSense backend. The repository provides a CLI interface for managing essential GraphSense maintenance tasks and provides a REST interface used by the frontend (UI). It acts as the core repository, delivering foundational tools

ntfsfind

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

fit-webview-bridge

FIT WebView Bridge is a cross‑platform Qt widget (C++/Objective‑C++) with PySide6 bindings that wraps the OS‑native web engines (Edge WebView2 on Windows, WKWebView on macOS, WebKitGTK** on Linux)

forensic-cli

https://pypi.org/project/forensic-cli/

tgartifacts

Python app for auditing tdata Telegram Desktop 6.x and 4.x versions. Support decrypting tdata, extractring cache, settings, MTProto data from tdata directory

graphsense-clustering

A central repository for Python utility functions and all components that interact with the GraphSense backend. The repository provides a CLI interface for managing essential GraphSense maintenance tasks and provides a REST interface used by the frontend (UI). It acts as the core repository, delivering foundational tools

xleapp

xLEAPP - Merging of iLEAPP/RLEAPP/vLEAPP, ALEAPP, cLEAPP

forensia

Your local AI assistant for weekend forensic work.

registryspy

Cross-platform registry browser for raw Windows registry files

favicorn-osint

All-sources tool to search websites by favicons

xleapp-ios

iOS Plugins for xLEAPP

edf-helium-client

Collaborative Forensic Collections Manager

edf-helium-server

Collaborative Forensic Collections Manager

edf-helium-core

Collaborative Forensic Collections Manager

cyberscanai

AI Agent Tool for Penetration Testing and Network Forensics

exespy

ExeSpy is a cross-platform PE viewer for EXE and DLL files

pymem-snapshot

PyMem - Memory Acquisition Tool