forensicmatt

DFIR using Rust and Python with intent for NoSQL. Now playing with ML/AI.

Pinned Repositories

libtsk-rs
Wrapper for TSK (Sleuth Kit) Bindings
Language:Rust10 6 45
PancakeViewer
A DFVFS Backed Forensic Viewer
Language:Python36 7 206
pyshellitems
Python library and tools for handling shell items / property lists and stores / and extension blocks. This project is for learning purposes and is not maintained.
Language:Python8 3 01
PyWindowsThingies
Windows Thingies in Python for live use.
Language:Python24 7 12
RsWindowsThingies
Windows Thingies... but in Rust
Language:Rust23 4 78
RustyLnk
LNK to JSON
Language:Rust14 6 42
RustyMft
MFT to JSON
Language:Rust8 2 00
RustyPrefetch
Prefetch to JSON. This Project is for learning purposes and is not maintained.
Language:Rust11 3 31
RustyReg
Registry to JSON. This Project is for learning purposes and is not maintained.
Language:Rust12 4 01
RustyUsn
USN to JSON
Language:Rust22 5 65

forensicmatt's Repositories

forensicmatt/PancakeViewer
A DFVFS Backed Forensic Viewer
Language:Python36 7 206
forensicmatt/PyWindowsThingies
Windows Thingies in Python for live use.
Language:Python24 7 12
forensicmatt/RsWindowsThingies
Windows Thingies... but in Rust
Language:Rust23 4 78
forensicmatt/RustyUsn
USN to JSON
Language:Rust22 5 65
forensicmatt/RustyLnk
LNK to JSON
Language:Rust14 6 42
forensicmatt/RustyReg
Registry to JSON. This Project is for learning purposes and is not maintained.
Language:Rust12 4 01
forensicmatt/libtsk-rs
Wrapper for TSK (Sleuth Kit) Bindings
Language:Rust10 6 45
forensicmatt/pyshellitems
Python library and tools for handling shell items / property lists and stores / and extension blocks. This project is for learning purposes and is not maintained.
Language:Python8 3 01
forensicmatt/VanillaWindowsTools
Tools for parsing and playing with https://github.com/AndrewRathbun/VanillaWindowsReference data
Language:Rust7 3 0
forensicmatt/ActivitiesCacheParser
Parse Windows ActivitiesCache to JSONL. This project is for learning purposes and is not maintained.
Language:Python5 3 0
forensicmatt/r-winreg
Windows Registry Parsing Library
Language:Rust5 2 62
forensicmatt/aws-snap-io
Library for implementing Read Seek ontop of an AWS Snapshot
Language:Rust4 2 01
forensicmatt/JsonlTools
Tools for filtering and manipulating JSONL
Language:Rust4 2 0
forensicmatt/MonitorUserAssist
Tool that can monitor the UserAssist registry keys and decode UserAssist structs in real-time. This project is for learning purposes and is not maintained.
Language:Python4 4 0
forensicmatt/LogicalRegTool
A registry tool that can be ran on a logical volume. JSONL output for NoSQL. This project is for learning purposes and is not maintained.
Language:Python3 2 1
forensicmatt/PyRustyUsn
Python bindings for RustyUsn
Language:Python3 2 0
forensicmatt/sans509-helpers
Just a quick script to parse load balancer logs into json
Language:Python3 2 01
forensicmatt/WinObjectIdParser
ObjectID Parsers and Tools. This project is for learning purposes and is not maintained.
Language:Python3 5 2
forensicmatt/LogicalAvacado
A DFIR Tool for processing logical volumes and inserting records into ArangoDB. This project is for learning purposes and is not maintained.
Language:Python2 3 0
forensicmatt/LogicalJmpLnkTool
A jumplist and link tool that can be ran on a logical volume. JSONL output for NoSQL. This project is for learning purposes and is not maintained.
Language:Python2 2 0
forensicmatt/snapio-evtx-extractor
Tool that uses aws-snap-io and libtsk to extract EVTX files from an AWS snapshot.
Language:Rust2 2 0
forensicmatt/upcaseinfo-py
$UpCase:$Info parsing tool/lib in Python
Language:Python2 2 0
forensicmatt/upcaseinfo-rs
$UpCase:$Info parsing tool/lib in Rust
Language:Rust2 1 0
forensicmatt/evtx
A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
Language:Rust1 1 01
forensicmatt/r-shellitems
Shell Item Structures in Rust
Language:Rust1 3 0
forensicmatt/SetupApiLogParser
Parse Setup API Logs to JSONL
Language:Python1 3 0
forensicmatt/CtfdLogs2Arango
Ingest CTFd logs into ArangoDB
Language:Python2 0
forensicmatt/jmespath.rs
Rust implementation of JMESPath, a query language for JSON
Language:Rust1 0
forensicmatt/walkdir
Rust library for walking directories recursively.
Language:Rust1 0
forensicmatt/winapi-rs
Rust bindings to Windows API
Language:Rust1 0