Pinned Repositories
evtxgrep
filtering Windows Event Log files
evtxview
evtxview is a GUI viewer for Microsoft Windows evtx files (Windows event logs). I'm hacking this tiny tool because I need such a tool in most forensic investigations.
forensic-scripts
Collection of useful forensic scripts
ipgrep
search for IP addresses in text files
libpefile
library to parse PE files
mft2bodyfile
parses an $MFT file to bodyfile
ntdsextract2
This aims to be a collection of tools to forensically analyze Active Directory databases
python-evtxtools
Collection of command line tools to correlate windows event logs. This set of tools is aimed to be used at forensic investigations.
regview
Offline-viewer for registry files
rexgen
API Documentation
janstarke's Repositories
janstarke/rexgen
API Documentation
janstarke/ntdsextract2
This aims to be a collection of tools to forensically analyze Active Directory databases
janstarke/regview
Offline-viewer for registry files
janstarke/mft2bodyfile
parses an $MFT file to bodyfile
janstarke/forensic-scripts
Collection of useful forensic scripts
janstarke/dfir-esedb
A library to allow forensic analysis of EseDB files
janstarke/es4forensics
⛔️ DEPRECATED: Use https://github.com/dfir-dd/dfir-toolkit instead
janstarke/evtx2bodyfile
Parses a lot of evtx files and prints a bodyfile
janstarke/evtxtools
⛔️ DEPRECATED: Use https://github.com/dfir-dd/dfir-toolkit instead
janstarke/clap-markdown-dfir
Autogenerate Markdown documentation for clap command-line tools (forked from ConnorGray/clap-markdown)
janstarke/usnjrnl
Parses Windows $UsnJrnl files
janstarke/janstarke.github.io
janstarke/loghawk
A cli tool to display large CSV files
janstarke/mactime2
⛔️ DEPRECATED: Use https://github.com/dfir-dd/dfir-toolkit instead
janstarke/evtx
A Fast (and safe) parser for the Windows XML Event Log (EVTX) format
janstarke/cryptopals
janstarke/csvlens
Command line csv viewer
janstarke/dfir-timeline
Library for the creation of DFIR timelines
janstarke/dissect.target
The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).
janstarke/ecs_types
Rust types mapping to the elasticsearch common schema
janstarke/flow.record
Recordization library
janstarke/janstarke
janstarke/kb
Personal Knowledge Base
janstarke/libesedb
Library and tools to access the Extensible Storage Engine (ESE) Database File (EDB) format.
janstarke/liblnk
Library and tools to access the Windows Shortcut File (LNK) format
janstarke/lnk-rs
A Rust library for parsing and writing MS Shell Links (shortcuts, *.lnk)
janstarke/memoverlay
Puts a writable layer of bytes over some byte stream
janstarke/pol_export
⛔️ DEPRECATED: Use https://github.com/dfir-dd/dfir-toolkit instead
janstarke/sleuthkit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
janstarke/zip-old
Zip implementation in Rust