Open-source DFIR tools for evidence-driven investigations.

Tools

Open-source DFIR tools for evidence-driven investigations.

A growing set of open-source tools for digital forensics and incident response. Each one is scriptable, built for real casework, and documented from its own source code.

Search tools and documentation Search

Quick start

Run a tool from the command line. For example, parse a Windows event log with EventHawk and save the results as JSON (from a source install):

> py -3 evtx_tool.py parse C:\Logs\Security.evtx --output results.json

Tools

1 documented · 4 coming soon

• EventHawk

  Version v1.3.0 License: Apache-2.0

  Windows Event Log (EVTX) analysis for DFIR: parallel parsing, DFIR profiles, ATT&CK mapping, IOC extraction and timelines.

  • Windows
  • DFIR

• Prefetch Parser (source repository on GitHub)

  Coming soon

  Cross-platform Windows Prefetch (.pf) parser with a command line and a GUI.

  • Windows
  • Forensics

• PhonePe Android Forensics (source repository on GitHub)

  Coming soon

  Offline, read-only analyser that rebuilds PhonePe Android app data into a unified timeline.

  • Android
  • Mobile

• Paytm Forensics (source repository on GitHub)

  Coming soon

  Offline, read-only forensic parser for data acquired from the Paytm Android app.

  • Android
  • Mobile

• WhatsApp Web Extractor (source repository on GitHub)

  Coming soon

  Forensic export of WhatsApp Web data from a browser profile on disk.

  • Browser
  • Forensics

About

DigitalForenSeek publishes practical, open-source tooling for DFIR work. Documentation on this site is written from each tool’s repository; anything the source does not confirm is marked as pending rather than guessed. Source code, issues and releases live on GitHub.