Search Results for "forensic"

Plaso (Plaso Langar Að Safna Öllu), or "super timeline all the things," is a Python-based engine designed for automatic creation of timelines in digital forensic investigations. It processes various log files and artifacts to generate a chronological sequence of events, aiding analysts in understanding system activities.​

An extensible network forensic analysis framework. Enables rapid development of plugins to support the dissection of network packet captures. This is a major framework update to Dshell. Plugins written for the previous version are not compatible with this version, and vice versa. By extension, dpkt and pypcap have been replaced with Python3-friendly pypacker and pcapy (respectively).

...The generated HTML includes interactive navigation and can optionally be published to GitHub Gists for sharing with collaborators or embedding in other documentation. It also supports including the raw session JSON alongside the transcript for forensic or archival purposes.

...The framework includes features such as antivirus evasion, privilege escalation, and system persistence, enabling it to maintain access on compromised systems. It also incorporates techniques to avoid forensic analysis, such as self-deletion and cleaning traces after execution. The generated executables are optimized to be small and efficient, improving their ability to bypass security controls.

Rekall is a powerful memory forensics framework that turns raw RAM captures—or live system state—into structured artifacts investigators can query and script. It ships with a large collection of plugins that parse OS internals to recover processes, modules, sockets, registry hives, and file objects, even when rootkits try to hide them. The design emphasizes repeatability: investigators run well-defined analyses that produce timelines, indicators, and reports suitable for case work or...

...This is invaluable for post-mortem diagnosis of production daemons where reproducing a bug in a dev shell is impractical. pyringe can inject arbitrary Python into the target process, enabling on-the-spot logging, state dumps, or gentle patching to keep a system limping along while you gather evidence. It’s also useful for forensic snapshots: enumerate objects of a certain type, find reference cycles, or measure memory pressure without pre-instrumentation. While powerful, it’s designed for careful, auditable use—showing exactly what code runs and where—so teams can regain visibility when black-box processes go sideways.