sleuth-kit

A tool that detects files and directories that may be hidden by trojan and rootkits on Unix platforms

A Claude Code skill for forensic analysis of computer disk images.

Safety-first guide for corrupted video recovery from cameras, phones, drones, dashcams, CCTV, and storage media, with tested MP4/H.264/FAT32 tools.

Proof of concept forensic triage using rust and tsk. This does not work yet.

Autonomous DFIR agent for SIFT - cited findings, audited actions, zero hallucinated evil.

End-to-end digital forensics lab — forensic image acquisition with FTK Imager (E01 format, MD5/SHA-1 verification) and deleted file recovery & artifact analysis with Autopsy (The Sleuth Kit). Recovered 70+ deleted files from unallocated NTFS sectors. Educational DFIR project aligned with NIST SP 800-86.

Provides hands-on Docker-based labs for digital forensics and incident response training, featuring memory analysis, network analysis, and malware detection tools like Volatility, Sleuth Kit, and YARA.

End-to-end Windows DFIR investigation using NTFS artefacts, PowerShell history, Windows Event Logs, Edge SQLite analysis and timeline reconstruction.