Dfir Python Packages

iocextract

Defanged Indicator of Compromise (IOC) Extractor.

dissect

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

cortexutils

Cortex Analyzers Repository

turbinia

Automation and Scaling of Digital Forensics Tools

pyloobins

Living Off the Orchard: macOS Binaries (LOOBins) is designed to provide detailed information on various built-in "living off the land" macOS binaries and how they can be used by threat actors for malicious purposes.

yaralyzer

Visually inspect and force decode YARA and regex matches found in both binary and text data with colors. Lots of colors.

threatingestor

Extract and aggregate threat intelligence.

pyhindsight

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

polars-iptools

Polars extension for IP address parsing and enrichment including geolocation

cortex4py

Python API Client for Cortex

turbinia-api-lib

Automation and Scaling of Digital Forensics Tools

turbinia-client

Automation and Scaling of Digital Forensics Tools

recuperabit

A tool for forensic file system reconstruction.

ntfsdump

An efficient tool for extracting files, directories, and alternate data streams directly from NTFS image files.

maldump

Multi-quarantine extractor

flow-ioc

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

ipextract

High-performance IP address extraction from text, powered by Rust

luminaut

Casting light on shadow cloud deployments

generaptor

CLI generator for Velociraptor offline collector

ntfsfind

An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.

diskanalyzer

This package implements multiples libraries and tools to parse, analyze and extract informations from disk on the live system.

edf-helium-core

Collaborative Forensic Collections Manager

edf-helium-server

Collaborative Forensic Collections Manager

edf-helium-client

Collaborative Forensic Collections Manager