Forensics Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

sherlock-project

Hunt down social media accounts by username across social networks

python-evtx

Pure Python parser for Windows Event Log files (.evtx)

volatility3

Volatility 3.0 development

pylnk3

Python library for reading and writing Windows shortcut files (.lnk). Python 3 only.

prowler-cloud

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

turbinia

Automation and Scaling of Digital Forensics Tools

iphone-backup-decrypt

Decrypt an encrypted local iOS backup on Windows or MacOS

analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

pyhindsight

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

plaso

Super timeline all the things

iocx

An extensible, deterministic static‑analysis engine that extracts high‑signal IOCs from PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

andriller

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

stegoforge

The ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run 11 advanced detection engines to uncover hidden payloads.

chickadee

Yet another GeoIP resolution tool.

plarv-argus-sdk

Active guardrail for AI training. Prevents crashes before they happen.

recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

imessage-reader

Fetch imessages from chat.db

logdissect

CLI utility and Python module for analyzing log files and other data.

msglite

Extracts emails and attachments saved in Microsoft Outlook's .msg files

turbinia-api-lib

Automation and Scaling of Digital Forensics Tools

turbinia-client

Automation and Scaling of Digital Forensics Tools