Security Ronin
Change the repository type filter
All
Repositories list
90 repositories
issen
PublicPoint it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps…disk-forensic
Publicdar-forensic
PublicPure-Rust forensic reader + anomaly auditor for Denis Corbin DAR (Disk ARchiver) archives, incl. Passware Kit Mobile / Cellebrite mobile extractions; formats 1-…browser-forensic
PublicParse Chrome/Firefox/Safari and embedded-Chromium app artifacts — history, cookies, web storage, integrity/tampering, free-page carving, container discovery — i…sqlite-forensic
PublicRead-only SQLite forensic toolkit: carve deleted records (freelist/in-page/dropped-table/WAL/journal), read index b-trees & WITHOUT ROWID tables, WAL version hi…udf-forensic
Publicusb-forensic
PublicUSB device-history correlation engine — reconstructs USB connection history from every Windows artifact (registry, SetupAPI, event logs, LNK) plus macOS/Linux, …timeglyph
PublicDecode, identify & encode forensic timestamps — every reading ranked, scored, and cited — plus a forensic calendar (DST, leap seconds, GPS week, format epochs, …forensicnomicon
PublicDFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offli…homebrew-tap
Publicsrum-forensic
PublicSRUM forensics: prove whether a human was at the keyboard. Parse SRUDB.dat on Linux/macOS. Detect malware, exfiltration, and automated execution. Single static …web3-forensic
Publicese-forensic
Publicgpt-partition-forensic
PublicGUID Partition Table (GPT) analyzer for Rust — parses the table and grades it: CRC32 integrity, primary/backup divergence, partition overlaps, and protective/hy…mbr-partition-forensic
PublicForensic MBR analyzer: graded anomaly findings (structural, gap/slack carving, wipe & bootkit detection, CHS/LBA & GPT/VBR cross-checks) on a pure read-only MBR…xpress-huffman
PublicPure-Rust, panic-free decompressor for Microsoft Xpress-Huffman ([MS-XCA] §2.2.4) — the codec behind Win10+ prefetch, hiberfil.sys, SMB3 and registry-hive compr…peripheral-forensic
PublicExternal-device connection forensics — parse setupapi.dev.log into a typed DeviceConnection timeline across USB, FireWire, Thunderbolt, PCIe, eSATA, SD; classif…leveldb-forensic
Publicprotobuf-forensic
Publicusnjrnl-forensic
PublicThe most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery…memory-forensic
PublicWalk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.blob-decoder
Publicwinevt-forensic
PublicEVTX forensic library suite — carve records from corrupt files, detect tampering indicators, analyze ETW sessions. No runtime deps.lzo
PublicGPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies…ewf
Public archivevhdx-forensic
PublicPure-Rust VHDX (Hyper-V) virtual-disk reader and forensic integrity analyzer: a hardened Read+Seek container reader (vhdx-core) plus a 63-code tamper/anomaly au…ntfs-forensic
PublicFrom-scratch NTFS reader (ntfs-core: MFT, attributes, indexes, data runs, LZNT1, $UsnJrnl:$J change journal over Read+Seek) plus a graded anomaly auditor (ntfs-…iso9660-forensic
PublicForensic ISO 9660 reader & tamper analyzer in pure Rust — analyse() surfaces 23 anomaly findings (redundancy, slack, EDC/ECC, concealment) across multi-session,…hfsplus-forensic
Publicforensic-vfs
PublicRead-only forensic VFS contracts — the ImageSource positioned-read byte source, PathSpec locators, and the FileSystem trait; the KNOWLEDGE leaf every fleet read…
ProTip! When viewing an organization's repositories, you can use the
props. filter to filter by custom property.