Popular repositories Loading
-
usnjrnl-forensic
usnjrnl-forensic Public archiveThe most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery, anti-forensics detection, timestomp…
Rust 33
Repositories
- ufs-forensic Public
UFS/FFS forensic library — parse UFS1/UFS2 (superblock, cylinder groups, inodes, directories, indirect blocks), detect anomalies, carve deleted files. Pure-Rust, panic-free, fuzzed, Tier-1 (dfvfs+TSK).
- xfs-forensic Public
XFS forensic library — parse XFS (superblock, AG headers, inodes, bmbt extents, directories), detect integrity anomalies, carve deleted inodes. Pure-Rust, panic-free, fuzzed, Tier-1 (dfvfs).
- ewf-forensic Public
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
- hfsplus-forensic Public
Forensic-grade Apple HFS+/HFSX reader — volume header, catalog B-tree directory listing, and data-fork file extraction
- iso9660-forensic Public
Forensic ISO 9660 reader & tamper analyzer in pure Rust — analyse() surfaces 23 anomaly findings (redundancy, slack, EDC/ECC, concealment) across multi-session, Rock Ridge, Joliet, El Torito & raw CD images
- filevault-forensic Public
Apple FileVault 2 / CoreStorage (FVDE) forensic library — parse the encryption context, unlock via password, decrypt AES-XTS volumes, and grade protector/encryption-state/weak-KDF findings. Panic-free, validated byte-for-byte against libfvde.
- veracrypt-forensic Public
VeraCrypt/TrueCrypt forensic library — brute the header PRF+cipher from a password, recover the master key, and decrypt the volume (AES/Serpent/Twofish, 5 PRFs, hidden volumes). Panic-free, no unsafe.
- luks-forensic Public
LUKS forensic library — parse LUKS1/LUKS2 headers, derive the master key, and decrypt the payload. Panic-free, no unsafe, cryptsetup-validated.
- bitlocker-forensic Public
BitLocker Drive Encryption (BDE) forensic library — parse FVE metadata, unlock via password, decrypt AES-CBC+Elephant-Diffuser volumes, and grade key-protector/clear-key/weak-cipher findings. Panic-free, validated byte-for-byte against libbde.
- fat-forensic Public
FAT/exFAT forensic library — parse FAT12/16/32 and exFAT filesystems, detect boot-sector/FAT-mirror anomalies, carve deleted entries. Single static binary, no runtime deps.
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…