All

121 repositories

memory-forensic
Public
Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.
rust incident-response dfir
rust incident-response dfir threat-hunting malware-analysis digital-forensics memory-analysis yara volatility lime
Rust
•
Apache License 2.0
•1•6•2•1•Updated Aug 14, 2026Aug 14, 2026
peira
Public
A knowledge system that refuses to promote a claim you have not examined — with gates drawn from Socratic elenchus, 金剛經, Nyāya, Madhyamaka and the causal ladder…
Rust
•
Apache License 2.0
•0•0•14•1•Updated Aug 14, 2026Aug 14, 2026
forensicnomicon
Public
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offli…
rust persistence incident-response
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara
Rust
•
Apache License 2.0
•2•4•0•0•Updated Aug 14, 2026Aug 14, 2026
ewf-forensic
Public
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
rust forensics dfir
rust forensics dfir digital-forensics e01 ewf tampering-detection integrity-checking
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 14, 2026Aug 14, 2026
usb-forensic
Public
USB device-history correlation engine — reconstructs USB connection history from every Windows artifact (registry, SetupAPI, event logs, LNK) plus macOS/Linux, …
windows macos linux
windows macos linux rust registry correlation usb timeline reproducible incident-response
Rust
•
Apache License 2.0
•0•0•10•1•Updated Aug 13, 2026Aug 13, 2026
state-history-forensic
Public
State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No…
rust incident-response forensics
rust incident-response forensics dfir digital-forensics temporal state-history
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
udf-forensic
Public
Forensic-grade UDF (ECMA-167/OSTA) reader — volume recognition, partition maps, File Entry/FID traversal, file data
Rust
•
Apache License 2.0
•1•1•0•2•Updated Aug 13, 2026Aug 13, 2026
shellitem
Public
Windows Shell Item / ITEMIDLIST (PIDL) parser — decode .lnk LinkTargetIDList and registry ShellBags into typed items + a reconstructed path. A reusable forensic…
windows rust incident-response
windows rust incident-response forensics dfir shell-item pidl itemidlist
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
lzo
Public
GPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies…
rust compression decompression
rust compression decompression forensics safe no-std lzo pure-rust lzop lzo1x
Rust
•
Apache License 2.0
•2•1•0•1•Updated Aug 13, 2026Aug 13, 2026
safe-decode
Public
Panic-free, allocating byte-to-value transforms with no format knowledge: ROT13, the UTF-16 decoder family with its NUL policy named in each function, and hex r…
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
lzvn
Public
Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).
macos rust apple
macos rust apple compression forensics dfir no-std decmpfs lzvn
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
jsonguard
Public
Secure output sanitization and input inspection for JSON/JSONL, CSV, and TSV — guards against formula injection, bidi-override, control-character, and encoding …
rust sanitization security
rust sanitization security tsv json csv injection bidi utf8 no-std
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
hfsplus-forensic
Public
Forensic-grade Apple HFS+/HFSX reader — volume header, catalog B-tree directory listing, and data-fork file extraction
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
forensic-vfs-mount
Public
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
forensic-hashdb
Public
File hash databases for digital forensics — NSRL/CIRCL known-good, malware known-bad, known-vulnerable Windows drivers (loldrivers), and analyst-supplied MD5/SH…
rust incident-response forensics
rust incident-response forensics dfir hashset digital-forensics nsrl loldrivers
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
forensic-carve
Public
Fleet carving contract + single-pass sweep engine: signature detection over unallocated/memory regions dispatched to per-format carvers.
rust incident-response forensics
rust incident-response forensics dfir digital-forensics data-recovery carving
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
elephant-diffuser
Public
The BitLocker Elephant Diffuser (Diffuser A + Diffuser B + sector-key XOR) in pure Rust — the format primitive with no ecosystem crate, validated in-situ agains…
rust cryptography encryption
rust cryptography encryption forensics dfir no-std bitlocker
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
wire-desktop-forensic
Public
Wire desktop forensic parser — recover conversations/records from IndexedDB; encrypted values surfaced not fabricated. Panic-free by lint.
rust messenger incident-response
rust messenger incident-response chromium forensics dfir wire digital-forensics
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 13, 2026Aug 13, 2026
veracrypt-forensic
Public
VeraCrypt/TrueCrypt forensic library — brute the header PRF+cipher from a password, recover the master key, and decrypt the volume (AES/Serpent/Twofish, 5 PRFs,…
rust cryptography encryption
rust cryptography encryption incident-response forensics dfir truecrypt digital-forensics xts veracrypt
Rust
•
Apache License 2.0
•1•1•0•0•Updated Aug 13, 2026Aug 13, 2026
disk-forensic
Public
Forensic disk-image orchestrator — decodes E01/VMDK/VHDX/VHD/QCOW2/DMG containers, auto-detects MBR/GPT/APM, and routes ISO 9660 to filesystem analysis
rust container dmg
rust container dmg apm forensics dfir disk-image partition ntfs mbr
Rust
•
Apache License 2.0
•0•3•0•1•Updated Aug 13, 2026Aug 13, 2026
zip-forensic
Public
Pure-Rust forensic ZIP toolkit: zip-full-core reader (no C-FFI, all common codecs + decryption) and zip-forensic anomaly auditor
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 13, 2026Aug 13, 2026
zfs-forensic
Public
ZFS forensic library — parse ZFS on-disk (vdev labels, uberblock, block pointers, DMU/dnode, ZAP/DSL/ZPL/SA), detect anomalies, carve deleted files via snapshot…
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 13, 2026Aug 13, 2026
xfs-forensic
Public
XFS forensic library — parse XFS (superblock, AG headers, inodes, bmbt extents, directories), detect integrity anomalies, carve deleted inodes. Pure-Rust, panic…
Rust
•
Apache License 2.0
•0•1•0•0•Updated Aug 13, 2026Aug 13, 2026
vsc-forensic
Public
Windows Volume Shadow Copy forensic library — reads VSS store/catalog structures, enumerates shadow copies, reconstructs each snapshot's point-in-time volume vi…
windows rust vss
windows rust vss incident-response forensics dfir ntfs digital-forensics snapshots volume-shadow-copy
Rust
•
Apache License 2.0
•0•1•0•0•Updated Aug 13, 2026Aug 13, 2026
vmdk-forensic
Public
Pure-Rust VMware VMDK toolkit: vmdk-core reader (imported as vmdk; recovers damaged disks via the redundant grain directory) + vmdk-forensic analyzer (RGD adjud…
rust vmware incident-response
rust vmware incident-response container forensics dfir disk-image forensic-analysis vmdk data-recovery
Rust
•
Apache License 2.0
•0•1•0•0•Updated Aug 13, 2026Aug 13, 2026
vhd-forensic
Public
Legacy VHD (Virtual PC) disk-image forensic reader — pure-Rust, read-only, no runtime deps.
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 13, 2026Aug 13, 2026
ufs-forensic
Public
UFS/FFS forensic library — parse UFS1/UFS2 (superblock, cylinder groups, inodes, directories, indirect blocks), detect anomalies, carve deleted files. Pure-Rust…
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 13, 2026Aug 13, 2026
cfb-forensic
Public
OLE/CFB ([MS-CFB]) forensic analyzer — carves compound files for orphaned (deleted) directory entries, free-sector + slack residue, and structural tamper tells.…
rust incident-response forensics
rust incident-response forensics dfir digital-forensics ole compound-file cfb carving jumplist
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
blob-decoder
Public
Scored identify + decode of unknown forensic BLOBs (bplist/base64/hex/uuid/gzip/zlib/snappy), with recursive unwrap
Rust
•
Apache License 2.0
•0•0•0•1•Updated Aug 13, 2026Aug 13, 2026
4n6mount
Public
Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4, AD1, zip/7z/tar, LiME…
windows rust fuse
windows rust fuse dokan filesystem incident-response forensics dfir disk-image ntfs
Rust
•
Apache License 2.0
•0•6•1•1•Updated Aug 13, 2026Aug 13, 2026

ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.

Navigation Menu

Security Ronin

All

All

121 repositories

memory-forensic

peira

forensicnomicon

ewf-forensic

usb-forensic

state-history-forensic

udf-forensic

shellitem

lzo

safe-decode

lzvn

jsonguard

hfsplus-forensic

forensic-vfs-mount

forensic-hashdb

forensic-carve

elephant-diffuser

wire-desktop-forensic

veracrypt-forensic

disk-forensic

zip-forensic

zfs-forensic

xfs-forensic

vsc-forensic

vmdk-forensic

vhd-forensic

ufs-forensic

cfb-forensic

blob-decoder

4n6mount

All

All

Repositories list

121 repositories