Forensics Python Packages

oletools

oletools - python tools to analyze MS OLE2 files (Structured Storage, Compound File Binary Format) and MS Office documents, for malware analysis, forensics and debugging.

prowler

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

sherlock-project

Hunt down social media accounts by username across social networks

python-evtx

Pure Python parser for Windows Event Log files (.evtx)

volatility3

Volatility 3.0 development

pylnk3

Python library for reading and writing Windows shortcut files (.lnk). Python 3 only.

prowler-cloud

Prowler is the world’s most widely used open-source cloud security platform that automates security and compliance across any cloud environment.

mvt

MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise.

turbinia

Automation and Scaling of Digital Forensics Tools

iphone-backup-decrypt

Decrypt an encrypted local iOS backup on Windows or MacOS

pyhindsight

Browser forensics tool for Google Chrome (and other Chromium-based browsers)

analyzemft

analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in multiple formats.

iocx

An extensible IOC extraction engine for PE binaries and text, built for SOC automation and modern threat‑analysis pipelines.

plaso

Super timeline all the things

cortex-persist

Cryptographic memory integrity, audit trails, and verifiable lineage for AI agents.

recoverpy

Interactively find and recover deleted or :point_right: overwritten :point_left: files from your terminal

imessage-reader

Fetch imessages from chat.db

andriller

📱 Andriller - is software utility with a collection of forensic tools for smartphones. It performs read-only, forensically sound, non-destructive acquisition from Android devices.

chickadee

Yet another IP address enrichment tool

turbinia-api-lib

Automation and Scaling of Digital Forensics Tools

stegoforge

The ultimate steganography and digital forensics toolkit. Hide and extract data across images, audio, video, documents, and network packets, or run 11 advanced detection engines to uncover hidden payloads.

plarv-argus-sdk

Clinical-grade training telemetry and forensic guardrails for large-scale AI models. Real-time gradient collapse detection, autonomous recovery, and ADQI scoring.

logdissect

CLI utility and Python module for analyzing log files and other data.

turbinia-client

Automation and Scaling of Digital Forensics Tools