Forensics Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

sherlock-project

Hunt down social media accounts by username across social networks

python-evtx

Pure Python parser for Windows Event Log files (.evtx)

pylnk3

Python library for reading and writing Windows shortcut files (.lnk). Python 3 only.

volatility3

Volatility 3.0 development

prowler-cloud

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

iphone-backup-decrypt

Decrypt an encrypted local iOS backup on Windows or MacOS

plaso

Super timeline all the things

pyhindsight

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

pst-search

Local search engine for Outlook PST files. SQLite FTS5 + pst-extractor (Node). Reads PSTs libpff cannot.

atb-sdk

ATB bundle reader and verifier SDK

turbinia

Automation and Scaling of Digital Forensics Tools

diffinite

Forensic source-code comparison for IP litigation — Winnowing/MOSS fingerprints + courtroom-ready PDF reports (Bates numbering, evidence hashing). pip install diffinite

turbinia-api-lib

Automation and Scaling of Digital Forensics Tools

msglite

Extracts emails and attachments saved in Microsoft Outlook's .msg files

iocx

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

turbinia-client

Automation and Scaling of Digital Forensics Tools

recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

andriller

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

cortex-persist

Cryptographic memory integrity, audit trails, and verifiable lineage for AI agents.

metabeam

Metadata extraction for any file type: detect MIME from magic bytes, read EXIF/GPS, image/audio/video tags, PDF info, archive contents, hashes, and entropy.