Forensics Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

python-evtx

Pure Python parser for Windows Event Log files (.evtx)

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

pylnk3

Python library for reading and writing Windows shortcut files (.lnk). Python 3 only.

sherlock-project

Hunt down social media accounts by username across social networks

volatility3

Volatility 3.0 development

filegrail

Trace file provenance, metadata, telemetry, investigative pivots and relationships across files, browser history, OS traces and archives. Local, read-only, no network requests.

iphone-backup-decrypt

Decrypt an encrypted local iOS backup on Windows or MacOS

mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

prowler-cloud

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

plaso

Super timeline all the things

pyhindsight

Browser forensics tool for Google Chrome, other Chromium-based browsers, and Mozilla Firefox

unmasker

Detect hidden, residual, and machine-readable content in documents, images, and files.

pypstreader

Production-ready pure-Python reader for Outlook PST stores — zero dependencies, differentially verified against Microsoft's Rust outlook-pst. Export to mbox and .eml.

seerdb

Pure-Python DB-API 2.0 driver for a proprietary database — speaks its native TNS/TTC wire protocol directly (8i through 26ai), no vendor client libraries

reg2es

A command-line tool for parsing Windows NT Registry(REGF format) and importing the results into Elasticsearch.

analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

ventra

Cloud forensic triage for AWS, Azure, GCP and Kubernetes

hotato

Find what broke in your agent calls. Pin it so it never ships again. Local voice-agent call forensics and regression guards.

ntfsdump

A command-line tool for efficiently extracting files, directories, and alternate data streams directly from NTFS image files.

mulder-dfir

Agentic DFIR

hdd-analyzer

Use Jev to quickly search your old hard drives and identify anything of value.

ntfsfind

A command-line tool for searching files, directories, and alternate data streams directly from NTFS image files.

office-password-toolkit

Detect, extract, bypass, and decrypt passwords and protection in Microsoft Office and OpenDocument files