Hands-on projects for beginners to learn and practice Windows forensics and essential cybersecurity skills
-
Updated
Jun 29, 2024
#
windows-forensics
Here are 81 public repositories matching this topic...
Cross-platform registry browser for raw Windows registry files
-
Updated
Apr 15, 2023 - Python
Windows forensics Engine
registry logs prefetch forensics mru ai-agents mft usn srum windows-forensics forensics-tools forensics-data identity-engine ai-forensics crow-eye shell-items shellbags
-
Updated
Jul 18, 2026 - Python
ExeSpy is a cross-platform PE viewer for EXE and DLL files
-
Updated
Feb 19, 2025 - Python
Vault of Windows Registry forensic artifacts
-
Updated
Nov 12, 2025 - JavaScript
Rust DFIR tool that massively parses cross-platform evidence, even deleted logs, into a lateral movement timeline and graph database.
rust neo4j vss incident-response dfir graph-database event-log threat-hunting digital-forensics cypher ual evtx kape lateral-movement velociraptor memgraph digital-forensics-incident-response windows-forensics digital-forensic-tool forensic-tool
-
Updated
May 21, 2026 - Rust
A comprehensive MCP server for Windows digital forensics on KALI Linux
-
Updated
May 21, 2026 - YARA
A DFIR Incident Response AI bot using local Ollama LLM to derrive automated findings from logs
incident-response dfir digital-forensics triage live-response windows-forensics forensics-tools llm ollama dfirvault ir-tools dfir-ai dfir-llm
-
Updated
Jan 17, 2026 - Python
Tools and Techniques for Digital Forensics and Incident Response
incident-response dfir digital-forensics digital-forensics-incident-response windows-forensics linux-forensics
-
Updated
Feb 16, 2026
Command Spy is a utility for monitoring the command line arguments of new processes on Windows. Made for CCDC.
-
Updated
Jul 30, 2023 - C#
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
rust timeline incident-response forensics dfir ntfs digital-forensics sigma yara memory-forensics threat-intelligence mitre-attack evtx browser-forensics velociraptor duckdb windows-forensics disk-forensics linux-forensics attack-flow
-
Updated
Jul 18, 2026 - Rust
Python module for forensic analysis of Windows shortcuts (LNK files). You can install this package using pip install lnkanalyser
-
Updated
Mar 28, 2024 - Python
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Jan 21, 2026
When conducting an investigation on a Windows machine there are 8 phase to go through, today we’ll discuss the first ‘Collecting Volatile Information’, and the rest will be explained in future topics
windows forensics cybersecurity cyber-security investigation windows-forensics forensics-tools sans500 cyberred
-
Updated
Sep 24, 2023
EVTX forensic library suite — carve records from corrupt files, detect tampering indicators, analyze ETW sessions. No runtime deps.
rust log-analysis incident-response forensics dfir digital-forensics anti-forensics memory-forensics security-tools blue-team evtx windows-event-log windows-forensics hayabusa winevt
-
Updated
Jul 11, 2026 - Rust
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
rust incident-response dfir threat-hunting malware-analysis digital-forensics memory-analysis yara volatility lime ld-preload memory-forensics dpapi windows-forensics linux-forensics avml rootkit-detection ioc-detection elf-analysis
-
Updated
Jul 16, 2026 - Rust
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara triage memory-forensics mitre-attack lolbins kape velociraptor windows-forensics linux-forensics macos-forensics forensic-artifacts
-
Updated
Jul 19, 2026 - Rust
Practical labs, case studies, and investigation notes for CHFI v11 — covering digital forensics, malware forensics, incident response, evidence collection, and analysis tools.
network-forensics data-acquisition digital-forensics computer-forensics memory-forensics mobile-forensics evidence-collection windows-forensics disk-forensics cyber-forensics linux-forensics malware-forensics chfi cyber-investigation cybercrime-investigation log-anaysis forensics-analysis
-
Updated
Aug 31, 2025
Useful tools for (not only) digital forensics
network-forensics incident-response digital-forensics memory-forensics mobile-forensics windows-forensics linux-forensics macos-forensics ios-forensics live-forensics android-forensics mobile-forensic webbrowsers-forensics
-
Updated
Jul 18, 2026
Valhuntir Windows forensic tool execution via MCP
-
Updated
May 11, 2026 - Python
Improve this page
Add a description, image, and links to the windows-forensics topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the windows-forensics topic, visit your repo's landing page and select "manage topics."