FindUSBMSC
A script to parse macos legacy system.log files for USB mass storage device entries and correlates the USBMSC to the USB ID database. The script will go through compressed gzip or uncompressed files....
View ArticleDiscUtils
DiscUtils is a .NET library to read and write ISO files and Virtual Machine disk files (VHD, VDI, XVA, VMDK, etc). DiscUtils is developed in C# with no native code (or P/Invoke). Category: Misc...
View ArticlepyMetaDive_PDF
A python script to parse PDF file metadata. Â Category: MetadataCategory URL: http://www.dfir.training/component/mtree/tools/forensic-utilities/metadata?Itemid=
View ArticleClik here to view.
Dahua Toolbox
Category: VideoCategory URL: http://www.dfir.training/component/mtree/tools/forensic-utilities/video?Itemid=
View ArticleEWF Metaeditor
Edit Encase EWF (.eo1) Â properties to correct errors or add more information.Category: Imaging and Image MountingCategory URL:...
View ArticleX_Ways_Automation
Python Script to automate the X-Ways processCategory: X-Ways 3rd Party ToolsCategory URL: http://www.dfir.training/component/mtree/tools/by-developer/3rd-party?Itemid=
View ArticleMetadata Interrogator
Grabs any and all possible metadata from a wide range of files. Graphical User Interface. Completely portable. Offline GPS resolving (as of version 0.2). Flags potential items of interest...
View ArticleGPS
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleMobile Devices
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleImages (photos)
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleOS: Windows
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleOS: iOS
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleIP addresses
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleOS: Android
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleSocial Media
Category: GeolocationCategory URL: http://www.dfir.training/component/mtree/artifacts/geolocation?Itemid=
View ArticleChrome
Category: BrowsersCategory URL: http://www.dfir.training/component/mtree/artifacts/internet/browsers?Itemid=
View ArticleFirefox
Category: BrowsersCategory URL: http://www.dfir.training/component/mtree/artifacts/internet/browsers?Itemid=
View ArticleExplorer/Edge
Category: BrowsersCategory URL: http://www.dfir.training/component/mtree/artifacts/internet/browsers?Itemid=
View ArticleOther
Category: BrowsersCategory URL: http://www.dfir.training/component/mtree/artifacts/internet/browsers?Itemid=
View ArticleDropbox
Category: CloudCategory URL: http://www.dfir.training/component/mtree/artifacts/internet/cloud?Itemid=
View Article