Incident Response Hierarchy of Needs

Safe Rust API to libesedb

A static analyzer for PE executables.

pcqf (PC Quick Forensics) helps quickly gathering forensic evidence from Windows, Mac, and Linux systems, in order to identify potential traces of compromise.

search for IP addresses in text files

Parse Windows LNK files and create bodyfile output

A Fast (and safe) parser for the Windows XML Event Log (EVTX) format

RegRipper3.0

Rapidly Search and Hunt through Windows Forensic Artefacts

A parser for the MFT (Master File Table) format

A cryptography library from NICS Lab

YARA signature and IOC database for my scanners and tools