Popular repositories Loading
-
usnjrnl-forensic
usnjrnl-forensic PublicThe most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery, anti-forensics detection, timestomp…
Rust 31
Repositories
- forensic-vfs-engine Public
The forensic-vfs registry + resolver — one Vfs::open(path) that detects the container/volume/filesystem stack and mounts a read-only dyn FileSystem. Batteries-included: every fleet reader compiled in.
SecurityRonin/forensic-vfs-engine’s past year of commit activity - issen Public
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
SecurityRonin/issen’s past year of commit activity - blazehash Public
Forensic file hasher — BLAKE3 at 1,640 MB/s, 25 hash algorithms, Ed25519 + post-quantum signing, Bitcoin timestamps, YARA scanning, 50+ remote backends. hashdeep for the modern era.
SecurityRonin/blazehash’s past year of commit activity - fat-forensic Public
FAT/exFAT forensic library — parse FAT12/16/32 and exFAT filesystems, detect boot-sector/FAT-mirror anomalies, carve deleted entries. Single static binary, no runtime deps.
SecurityRonin/fat-forensic’s past year of commit activity - disk-forensic Public
Forensic disk-image orchestrator — decodes E01/VMDK/VHDX/VHD/QCOW2/DMG containers, auto-detects MBR/GPT/APM, and routes ISO 9660 to filesystem analysis
SecurityRonin/disk-forensic’s past year of commit activity - qcow2-forensic Public
Pure-Rust QCOW2 forensics: reader (qcow2-core) + anomaly auditor (qcow2-forensic) — backing files, snapshots, encryption, refcount orphans on the forensicnomicon report model
SecurityRonin/qcow2-forensic’s past year of commit activity - ewf-forensic Public
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
SecurityRonin/ewf-forensic’s past year of commit activity - lzvn Public
Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).
SecurityRonin/lzvn’s past year of commit activity - udf-forensic Public
Forensic-grade UDF (ECMA-167/OSTA) reader — volume recognition, partition maps, File Entry/FID traversal, file data
SecurityRonin/udf-forensic’s past year of commit activity
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…