Tools

The Android counterpart to iLEAPP — parses an Android filesystem or physical extraction into categorised, human-readable reports covering messaging, browser, app and system artifacts.

python3 aleapp.py -t fs -i extraction/ -o report/

Eric Zimmerman's parser for Amcache.hve — a registry hive tracking executed and installed applications, including SHA1 hashes and first-execution timestamps.

AmcacheParser.exe -f Amcache.hve --csv out

Extracts every thumbnail and the exact upload timestamp from a YouTube video, used to verify when a video was actually first published.

Cross-platform Python NTFS $MFT parser — a free, scriptable alternative to MFTECmd for extracting file record metadata from a raw MFT extract.

analyzeMFT.py -f \$MFT -o mft.csv

Eric Zimmerman's parser for the Shimcache (AppCompatCache) registry value — a list of executables the OS has seen, one more source of program-execution evidence.

AppCompatCacheParser.exe -f SYSTEM --csv out

Large-scale, indexed full-packet capture — captures and stores traffic while indexing session metadata for search, so a SOC can pull the exact PCAP for an alert from months of retained traffic instead of scrolling Wireshark.

Mounts forensic disk images (E01, dd, VHD and more) as native Windows disks, read-only and write-cached, so any Windows tool can browse or run analysis against them without a physical write-blocker.

The graphical front-end to The Sleuth Kit — a complete open-source digital forensics platform for disk images: timeline analysis, keyword search, file recovery and more.

Sysinternals tool enumerating every autostart location on Windows (run keys, services, scheduled tasks, WMI, browser helper objects…) — the fastest way to spot a persistence mechanism.

autorunsc.exe -accepteula -a * -c -h -s > autoruns.csv

Microsoft's Acquire Volatile Memory for Linux — a self-contained, dependency-free memory acquisition tool designed to work across kernels without a matching LiME module.

./avml output.lime

Diffing enabled units against a known-good baseline is a fast way to spot a persistence unit an attacker added, without waiting for full artifact collection.

systemctl list-unit-files --state=enabled | sort > current_units.txt
diff baseline_units.txt current_units.txt

Free lightweight Windows memory acquisition tool from Belkasoft — designed to run cleanly even against systems with anti-debugging/anti-dumping protections.

Identifies and extracts embedded files and firmware images buried inside a binary blob — signature-scans for known file/filesystem headers and carves out what it finds.

binwalk -e firmware.bin

Desktop app for searching and analysing large pcap/Zeek log sets with the Zed query language — much faster iteration than opening a huge capture in a GUI packet viewer.

Scans a disk image, memory dump or arbitrary blob for recognisable features (email addresses, credit-card numbers, URLs, EXIF data) using carving and regex, ignoring filesystem structure entirely — useful when the filesystem is damaged or unknown.

bulk_extractor -o output/ disk.dd

Cyber Defense Institute's free Windows artifact collector — grabs registry hives, event logs, prefetch, browser history and more into one archive for offline analysis.

Commercial mobile device forensics platform (UFED and related products) — the industry-standard hardware/software for extracting and decoding data from seized mobile devices.

Fast command-line triage of Windows Event Logs — runs Sigma rules and built-in detection logic across EVTX files to surface logons, lateral movement and other indicators without loading them into a SIEM first.

chainsaw hunt evtx_dir/ -s sigma_rules/ --mapping mappings/sigma-event-logs-all.yml

A quick compliance and incident-response check; an unencrypted disk changes what is recoverable from a lost or seized machine.

fdesetup status

/etc/ld.so.preload is loaded into every dynamically linked binary on the system, a favourite location for rootkit persistence.

cat /etc/ld.so.preload 2>/dev/null
ls -la /etc/ld.so.preload

An unexpected bind mount or overlay filesystem can be a container escape artifact or a hidden persistence location.

mount | column -t
findmnt

The immutable attribute is sometimes set on a tampered binary or config to stop even root from silently editing it back.

lsattr -R /etc /bin /usr/bin 2>/dev/null | grep -- '----i'

spctl reports exactly why Gatekeeper would allow or block an app, signed, notarized, or neither, before deciding whether to trust it.

spctl -a -vv /Applications/Suspicious.app

A fast first pass on an IR call — who has logged in recently, who is on the box right now, and whether wtmp shows anything that does not line up with what the customer told you.

last -F -x | head -30
w
lastb -F | head -20   # failed logins, if btmp is enabled

Deprecated since OS X 10.10 but still executed if present, and still checked by both malware and thorough incident responders.

ls -la /Library/StartupItems /System/Library/StartupItems 2>/dev/null

Login and logout hooks are a deprecated but still-functional per-user persistence mechanism configured under com.apple.loginwindow.

defaults read com.apple.loginwindow LoginHook 2>/dev/null
defaults read com.apple.loginwindow LogoutHook 2>/dev/null

/etc/periodic is an older but still-functional persistence point inherited from macOS BSD lineage, checked less often than LaunchAgents.

ls -la /etc/periodic/daily /etc/periodic/weekly /etc/periodic/monthly

Blue-team sweep of the classic autorun keys that survive reboot, the first place most simple malware persists.

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"

A malicious line appended to .zshrc or .bash_profile re-executes on every new terminal session, a common and easily missed persistence spot.

cat ~/.zshrc ~/.zprofile ~/.bash_profile ~/.bashrc 2>/dev/null

The com.apple.quarantine extended attribute is what triggers the "are you sure you want to open this" prompt, worth checking in any investigation.

xattr -l ~/Downloads/suspicious.dmg

Reads macOS's TCC (Transparency, Consent and Control) database to show which apps were granted access to sensitive data — a common forensic/incident-response first step.

sqlite3 ~/Library/Application\ Support/com.apple.TCC/TCC.db "select client,auth_value,service from access;"

Quick manual triage step before uploading a sample anywhere — hash it locally and grep against a downloaded IOC list (e.g. exported from MISP/ThreatFox) offline.

sha256sum suspicious.bin | tee /dev/stderr | cut -d' ' -f1 | grep -Ff known_bad_hashes.txt && echo MATCH

Most macOS configuration and persistence artifacts are binary plists; this makes them greppable like any other text file.

plutil -convert xml1 -o - ~/Library/Preferences/com.apple.suspicious.plist

The first thing to run on any box during triage — what is listening, and what process owns it. Works the same shape on Linux and Windows.

# Linux
ss -ltnp
# Windows (PowerShell)
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess

GCHQ's "Cyber Swiss Army Knife" — a browser-based drag-and-drop pipeline for encoding, decoding, encryption and data-format transforms, arguably the single most-used CTF crypto/forensics tool there is.

Live-response collector that grabs a fixed set of forensic artifacts (MFT, registry, event logs, prefetch…) from a running Windows system into a single zip, without needing to shut it down.

CyLR.exe -od C:\evidence

The DoD Cyber Crime Center's forensic fork of GNU dd — adds on-the-fly hashing, progress reporting, split output and error logging that a plain dd lacks, for making verifiable evidentiary disk images.

dc3dd if=/dev/sdb hash=sha256 log=image.log of=image.dd

Another forensics-focused dd variant (originally DoD Computer Forensics Lab) — hashing, status output and multiple simultaneous output files during acquisition.

dcfldd if=/dev/sdb of=image.dd hash=sha256 hashlog=image.sha256

Data recovery tool built to image failing drives — reads good sectors first and retries bad ones intelligently, maximising recovered data from a dying disk.

ddrescue -f -n /dev/sdb image.dd image.log

A SANS PowerShell module that hunts Windows Event Logs for signs of attack — obfuscated PowerShell, suspicious account use, service creation — the kind of manual EVTX review a threat hunter would otherwise do by hand.

.\DeepBlue.ps1 -log security

Event ID 5007 fires whenever Defender configuration changes, the fastest way to notice someone quietly whitelisting their own tooling.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=5007}

-enc / -EncodedCommand is one of the most common obfuscation techniques seen in both commodity malware and offensive tooling.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} | Where-Object { $_.Message -match '-enc(odedcommand)?\s' }

Sysmon Event ID 10 with a GrantedAccess mask like 0x1010 or 0x1438 against lsass.exe is the standard signature of a credential-dumping attempt.

Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=10} | Where-Object { $_.Message -match 'lsass.exe' }

Security Event 4656 against HKLM\SAM is a strong indicator of an offline credential-dumping attempt via reg save.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4656} | Where-Object { $_.Message -match 'SAM' }

schtasks /create is a common way both attackers and legitimate admin tooling establish persistence; logging the event catches both.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4698}

ANSSI's forensic artifact collection tool for Windows — configurable, digitally-signed collectors gather volatile and on-disk evidence at scale across an enterprise.

Fox-IT's forensic framework for parsing disk images and filesystem artifacts at scale without mounting them — a Python toolkit built for automating triage across hundreds of acquisitions rather than one investigator, one image.

target-query disk.vmdk -f mft --csv

defaults read on an unfamiliar bundle ID can reveal configuration a piece of adware or malware wrote to persist its own settings.

defaults read com.apple.suspicious 2>/dev/null

Quick manual persistence check across the four most commonly abused Run/RunOnce keys, without needing Autoruns installed on the box.

reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Run"
reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"

An unfamiliar or unsigned module in the list is one of the more reliable signs of a kernel-level rootkit.

lsmod | sort

security is the built-in macOS CLI for keychain access — useful for authorised credential-recovery/incident-response work; it still prompts for the keychain password per item unless already unlocked.

security dump-keychain -d ~/Library/Keychains/login.keychain-db

Commercial mobile forensics tool for acquiring iOS/iCloud and some Android/BlackBerry backups and keychains — widely used in lawful mobile device examinations.

LaunchDaemons run as root at boot regardless of login, so an unfamiliar one here is a higher-severity find than a user LaunchAgent.

ls -la /Library/LaunchDaemons
plutil -p /Library/LaunchDaemons/*.plist

Per-user LaunchAgents run at login without needing root, making them the most common macOS persistence location for malware and legitimate tools alike.

ls -la ~/Library/LaunchAgents
plutil -p ~/Library/LaunchAgents/*.plist

A suite of free, individually-focused Windows forensic parsers — Registry Explorer, MFTECmd, EvtxECmd, PECmd (prefetch), Timeline Explorer and more — that between them cover most Windows artifact types KAPE collects.

MFTECmd.exe -f "$MFT" --csv out\

Eric Zimmerman's EVTX parser — turns Windows Event Logs into CSV/JSON/timeline output with maps for common event IDs, much faster than the native Event Viewer for bulk triage.

EvtxECmd.exe -f Security.evtx --csv out --csvf security.csv

Reads, writes and edits metadata across an enormous range of file formats — the standard tool for pulling (or stripping) EXIF, GPS and authorship data out of files.

exiftool suspicious.jpg

Runs an XPath query straight against an exported .evtx file with the built-in wevtutil, no PowerShell EVTX cmdlets or third-party parser required.

wevtutil qe Security.evtx /lf:true /q:"*[System[(EventID=4688)]]" /f:text > logons.txt

Pulls every IPv4 address and FQDN-looking string out of an arbitrary text blob (a vendor report, a phishing email, a log dump) for quick pivoting into a threat-intel lookup.

grep -oE '([0-9]{1,3}\.){3}[0-9]{1,3}' report.txt | sort -u
grep -oE '\b[a-z0-9.-]+\.[a-z]{2,}\b' report.txt | sort -u

strings piped through a targeted grep is still the fastest way to spot an embedded API key, password or URL in an unfamiliar binary.

strings -n 8 ./binary | grep -iE 'password|api[_-]?key|token|http://|https://'

Lightweight standalone Windows live-response collector — pulls processes, network connections, services, scheduled tasks and registry artifacts into a single CSV bundle.

Identifies a file's actual type by inspecting its content (magic bytes) rather than trusting its extension — the very first command to run on anything unidentified.

file suspicious.bin

ConsoleHost_history.txt often has the last few commands an admin ran, credentials and all, worth checking before assuming a box is a dead end.

Get-Content (Get-PSReadlineOption).HistorySavePath

On a box recently compromised or patched, files touched in the last hour are the fastest lead into what actually changed.

find / -xdev -mmin -60 -type f 2>/dev/null | grep -v -E '^/(proc|sys)'

Orphaned files, from a deleted user or a broken container mount, sometimes carry permissions from a since-removed privileged account.

find / -xdev \( -nouser -o -nogroup \) 2>/dev/null

A dotfile dropped outside the usual home-directory locations is a common, low-effort way malware hides its working directory.

find / -xdev -name ".*" -not -path "/home/*/.*" -not -path "/proc/*" 2>/dev/null

Surfaces 4732/4728 (member added to a security-enabled local/global group) events — the classic signal for privilege escalation via group membership abuse.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4732,4728} |
  Select-Object TimeCreated, Id, @{n='Member';e={$_.Properties[0].Value}}, @{n='Group';e={$_.Properties[2].Value}}

A plist edited outside a software update window is a strong signal of manual persistence tampering.

find /Library /System/Library ~/Library -name '*.plist' -mtime -7 2>/dev/null

Attacker-planted SUID binaries are a common Linux persistence/privesc trick; this lists every SUID/SGID file so you can eyeball it against a known-good baseline.

find / -xdev \( -perm -4000 -o -perm -2000 \) -type f -exec ls -la {} \; 2>/dev/null

A file-carving tool that recovers files from a disk image or raw data stream based on headers and footers, independent of the filesystem metadata around them.

foremost -i disk.img -o carved/

Browser-based image forensics toolkit (29a.ch) offering ELA, clone detection, noise analysis and metadata extraction without uploading the image anywhere.

Error Level Analysis and metadata forensics for a submitted photo, used to spot edited/composited regions and inconsistent compression history.

Exterro's free disk-imaging and preview tool — creates forensically sound images (E01/dd), previews a live system's files and memory, and generates hashes for chain-of-custody, without needing the full FTK suite.

Real-time terminal and browser web log analyzer — parses Apache/Nginx access logs on the fly for traffic, status codes and suspicious request patterns during an incident.

goaccess access.log -o report.html --log-format=COMBINED

Counts failed SSH password attempts per source IP from the system auth log — the fastest confirmation of a brute-force before reaching for fail2ban logs or a SIEM.

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn | head -20

Pulls every failed password attempt out of auth.log and ranks by source, the starting point for spotting a brute-force campaign.

grep 'Failed password' /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -rn

Pull failed-logon events straight from the command line for a quick brute-force check, without opening Event Viewer.

wevtutil qe Security /q:"*[System[(EventID=4625)]]" /f:text /c:20

Google's remote live-forensics framework — agents on endpoints answer forensic queries (files, processes, registry, memory) at scale for incident responders who cannot ship a disk image for every host.

Fast, free forensic disk imaging GUI for Linux — multi-threaded compression, EWF/E01/raw output and on-the-fly hash verification during acquisition.

Generates a SHA-256 hash list of an entire directory tree in one pass — feed the output into a threat-intel lookup or diff it against a known-good baseline.

find . -type f -exec sha256sum {} \; > hashes.txt

A Rust-based Windows Event Log fast-forensics timeline generator, built by Yamato Security — evaluates Sigma-compatible rules across EVTX files and outputs a scored, sortable timeline for triage.

hayabusa csv-timeline -d evtx_dir/ -o timeline.csv

Parses a Chrome/Chromium profile's history, cache, cookies, downloads and autofill into a single timeline and generates a Chrome-viewable HTML report — browser forensics without hand-decoding SQLite and LevelDB by hand.

python3 hindsight.py -i "Default" -o report

Greps Sysmon Event ID 1 (process creation) for a suspicious substring in the command line — quick manual hunting when you do not yet have a Sigma rule for it.

Get-WinEvent -LogName 'Microsoft-Windows-Sysmon/Operational' |
  Where-Object { $_.Id -eq 1 -and $_.Message -match 'EncodedCommand' } |
  Select-Object TimeCreated, Message

WMI event subscriptions (filter, consumer, binding) are a fileless persistence mechanism that a quick disk sweep will miss entirely.

Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class __EventConsumer
Get-WmiObject -Namespace root\subscription -Class __FilterToConsumerBinding

Parses a full-filesystem iOS extraction into readable, categorised forensic reports (messages, location, app usage, health data) — the standard open-source companion to a Cellebrite/GrayKey iOS acquisition.

python3 ileapp.py -t fs -i extraction/ -o report/

Hex editor built for reverse engineering, with a C++-like pattern language for describing and colour-highlighting a binary format live as you scroll through it.

Parses NTFS INDX ($I30) directory index attributes — surfaces filenames and timestamps for files that have since been deleted from a directory.

python INDXParse.py -d \$I30 > indx.csv

Browser-extension verification toolkit for images and video: keyframe extraction, reverse image search shortcuts and metadata inspection in one panel.

Long-running EXIF/GPS metadata viewer for an image URL or upload — a quick, no-signup way to check what a photo leaks before ExifTool is available.

Eric Zimmerman's jump list parser — extracts recently/frequently accessed files and applications from AutomaticDestinations/CustomDestinations jump-list files.

JLECmd.exe -d C:\Users\<u>\AppData\... --csv out

Kroll Artifact Parser and Extractor — targets collect and copy specific forensic artifacts (registry, event logs, prefetch, browser data…) and modules parse them, all in one fast pass.

kape.exe --tsource C: --tdest T:\triage --target !SANS_Triage --mdest M:\module --module !EZParser

Targeted collection and parsing of forensic artifacts from a live or imaged Windows system in minutes — pulls only the files that matter (registry hives, event logs, browser history, prefetch) instead of a full disk image.

kape.exe --tsource C: --tdest D:\triage --target !SANS_Triage

Eric Zimmerman's LNK (shortcut) file parser — recovers target paths, volume serials, MAC addresses and timestamps embedded in Windows shortcut files.

LECmd.exe -f target.lnk

Library and CLI tools for reading/writing the Expert Witness Format (E01) used by EnCase/FTK — acquire, verify and mount E01 images from the command line.

ewfacquire /dev/sdb

Loadable kernel module for full Linux memory acquisition over network or to local disk — the standard way to capture RAM from a live Linux host for forensic analysis.

insmod lime.ko "path=/mnt/usb/mem.lime format=lime"

Login items are a user-visible persistence mechanism distinct from LaunchAgents, and osascript can enumerate them without opening System Settings.

osascript -e 'tell application "System Events" to get the name of every login item'

Attacker C2 frameworks and lateral-movement tools frequently create distinctively named pipes; a mismatch against a known baseline is a fast lead.

[System.IO.Directory]::GetFiles("\.\pipe\")

launchctl list shows every job launchd currently manages, including a job with no on-disk plist left to find.

launchctl list | grep -v com.apple

macOS persistence almost always lives in a LaunchAgent or LaunchDaemon plist — this lists every one across the user and system locations in one pass.

ls -la ~/Library/LaunchAgents /Library/LaunchAgents /Library/LaunchDaemons 2>/dev/null

Extended attributes are an easy-to-overlook place to smuggle a small payload or marker outside a file normal content stream.

find / -xdev -exec getfattr -d {} \; 2>/dev/null | grep -B1 '^user\.'

A rogue Safari extension is a common, low-friction way to persist browser-based data theft; this enumerates what is installed without opening Safari.

ls -la ~/Library/Safari/AppExtensions ~/Library/Containers/com.apple.Safari/Data/Library/Safari/AppExtensions 2>/dev/null

Lists Keychain item service and account names, not the secrets themselves without further prompts, a fast way to see what credentials an account has stored.

security dump-keychain -d login.keychain | grep -A1 "0x00000007"

Third-party kexts are rare on modern macOS since most vendors moved to system extensions, which makes any unfamiliar one worth investigating immediately.

kextstat | grep -v com.apple

A process running from memory with a deleted or missing on-disk image is a strong process-injection/hollowing indicator — this osquery pulls exactly that condition.

osqueryi "SELECT pid, name, path, cmdline FROM processes WHERE on_disk = 0;"

Scheduled tasks are one of the most common Windows persistence mechanisms; this lists every task with its creation/last-run time so a recently added one stands out.

Get-ScheduledTask | Get-ScheduledTaskInfo |
  Sort-Object LastRunTime -Descending |
  Select-Object TaskName, LastRunTime, NextRunTime

Webshells and dropped files usually touch a file's mtime; this narrows a whole web root down to what changed in the suspected compromise window.

find /var/www -type f -mmin -1440 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort

A shadow copy can still hold an old SAM, SYSTEM or NTDS.dit, letting credentials be extracted without touching the live locked file.

vssadmin list shadows

A service binary path an unprivileged user can overwrite is a classic privilege-escalation and persistence weakness; this narrows the whole service list down to that condition.

Get-WmiObject win32_service | Where-Object { $_.StartName -eq 'LocalSystem' } |
  Select-Object Name, DisplayName, PathName, StartMode

Free triage tool that pulls and highlights the Windows Event Log entries and registry/config items that matter most for malicious activity detection and log hardening review.

Commercial DFIR platform from Magnet Forensics — unifies computer, mobile and cloud artifact recovery with a single timeline/case view, common in corporate and LE forensics labs.

Free Windows RAM acquisition tool from Magnet Forensics — simple GUI, outputs a raw memory image suitable for Volatility or Magnet AXIOM.

CISA's network traffic analysis toolset — packages Zeek, Suricata and Arkime with an OpenSearch/Kibana front end into one Docker-composed stack, for a full-fidelity network monitoring deployment without building it component by component.

Mounts a memory dump (or a live target over PCILeech/DMA) as a virtual filesystem — processes, modules, handles and the registry become browsable files and directories instead of Volatility plugin output.

mount -f memory.dmp

Browser-based metadata viewer for images, office documents, audio and video — a quick no-install alternative when ExifTool isn't available on the box you're using.

Extracts metadata (author names, software versions, paths) from public documents discovered via search engines for a target domain.

metagoofil -d example.com -t pdf,doc,xls -l 50 -n 20 -o results -f results.html

Eric Zimmerman's $MFT parser — turns the NTFS Master File Table into CSV, revealing file creation/modification timestamps and deleted entries for timeline building.

MFTECmd.exe -f \$MFT --csv out

A passive network forensics tool that reconstructs sessions, files, credentials and host details straight out of a PCAP — built for pulling artifacts out of captured traffic rather than live monitoring.

Generates a visual network diagram from a pcap — hosts, connections, Tor traffic and suspicious flows laid out graphically for a quick "what happened on this network" overview.

python PcapXray.py -f capture.pcap

Eric Zimmerman's Windows Prefetch parser — turns .pf files into execution history (run count, last-run times, loaded files) for proving what ran on a host and when.

PECmd.exe -d C:\Windows\Prefetch --csv out

TestDisk's companion file-carving tool — recovers files by signature from a raw disk image or damaged filesystem, ignoring the filesystem structure entirely, which makes it as useful for evidence recovery as for data recovery.

photorec /d recovered/ disk.dd

Framework for creating a "super timeline" from a forensic image — parses dozens of artifact formats into one chronologically sorted event stream for triage in Timesketch or a spreadsheet.

log2timeline.py timeline.plaso image.dd
psort.py -o l2tcsv -w timeline.csv timeline.plaso

Builds a "super timeline" from every timestamped artifact on a disk image or triage collection — filesystem metadata, registry, logs, browser history — merged into one chronological view for an investigator to filter.

log2timeline.py timeline.plaso disk.dd && psort.py -o l2tcsv -w timeline.csv timeline.plaso

Validates a PNG file's chunk structure and reports corruption, unusual/nonstandard chunks or data appended after the IEND marker — a quick check before hunting for hidden data manually.

pngcheck -v suspicious.png

Sysinternals tool logging real-time file system, registry and process/thread activity — the standard way to see exactly what a suspicious process is doing on a live Windows host.

procmon.exe /BackingFile trace.pml /Quiet /Minimized

Extracts and de-duplicates every source/destination IP seen in a capture with tshark, without loading the whole file into Wireshark.

tshark -r capture.pcap -T fields -e ip.src -e ip.dst | tr '\t' '\n' | sort -u

Pulls recent 4625 (failed logon) events with account and source IP, straight from PowerShell — the first check on a suspected brute-force or password-spray.

Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} -MaxEvents 50 |
  Select-Object TimeCreated, @{n='Account';e={$_.Properties[5].Value}}, @{n='SourceIP';e={$_.Properties[19].Value}} |
  Format-Table -AutoSize

On systemd hosts, journalctl replaces grepping flat log files and filters directly by unit, priority and time window.

journalctl -u sshd --since "1 hour ago" -p warning

Event ID 4624 with LogonType 3 (network) or 10 (RDP) is the backbone of almost any lateral-movement timeline reconstruction.

wevtutil qe Security /q:"*[System[(EventID=4624)]]" /f:text /c:20

log show replaces syslog on modern macOS and can filter directly for authorization and authentication activity in a given window.

log show --predicate 'eventMessage contains "authentication"' --last 1h

A fast triage check for CTF/pentest boxes — cgroup contents and the presence of .dockerenv are the two most reliable tells.

cat /proc/1/cgroup 2>/dev/null; ls -la /.dockerenv 2>/dev/null

Shows the quarantine extended attribute macOS stamps on anything downloaded from the internet — useful for both malware triage and testing your own tooling's execution path.

xattr -l suspicious_file

Blue-team side of the download cradle above: ScriptBlock logging (event 4104) captures the deobfuscated command even when it arrived base64-encoded.

Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" | Where-Object Id -eq 4104 | Select-Object -First 20 TimeCreated, Message

A process environment, including a credential passed via env rather than argv, is readable through procfs by the owning user or root.

for p in /proc/[0-9]*; do echo "== $p =="; strings $p/environ 2>/dev/null | grep -iE 'pass|key|token'; done

Eric Zimmerman's GUI registry hive viewer — bookmarked keys, deleted key recovery and a much friendlier interface than regedit for manual hive investigation.

Plugin-based Windows registry hive parser — runs a battery of small, purpose-built plugins over a hive (SAM, SYSTEM, SOFTWARE, NTUSER.DAT) to pull out exactly the keys an investigator actually looks for.

rip.pl -r SYSTEM -f system > system_report.txt

Google's memory forensics framework, forked from an earlier Volatility codebase before the two diverged — live memory analysis and plugin-based artifact extraction.

last reconstructs a login, logout and reboot timeline straight from wtmp, useful for confirming whether a suspicious session actually happened.

last -a | head -30
lastb | head -30

Eric Zimmerman's shellbags parser — reconstructs folders a user browsed, even ones since deleted, from the registry's shellbag structures.

SBECmd.exe -d C:\Users\<u>\NTUSER.DAT --csv out

Fast, configurable file carver — reads a header/footer definition file to extract specific file types from an unallocated disk image or memory dump.

scalpel -c scalpel.conf -o carved/ image.dd

When auditd is configured, ausearch turns its raw log into a readable timeline of exactly which process touched a watched file or syscall.

ausearch -k <watch-key> -ts recent

Root can read every user history file in one pass, useful in an incident-response sweep for a command that reveals lateral movement.

sudo find /home /root -name '.*_history' -exec sh -c 'echo == {} ==; cat {}' \;

On systemd hosts this finds a service that keeps crashing/restarting, which is often the visible symptom of a webshell or exploit repeatedly killing the parent process.

journalctl -u <service> --since '1 hour ago' | grep -Ei 'fail|restart|core dump'

Bash and zsh history commonly retain a plaintext password typed into a curl or mysql invocation months earlier.

grep -riE 'pass|secret|token|key' ~/.*history 2>/dev/null

mdfind queries the Spotlight index directly, often far faster than a raw find across an entire disk.

mdfind -name "id_rsa"

Curated collection of publicly available security-relevant datasets (network captures, logs, malware metadata) for research and detection-engineering practice.

Lists every Prefetch file with its last-modified time when a proper parser like PECmd is not available on the box you are triaging — a rough but immediate proxy for program execution history.

Get-ChildItem C:\Windows\Prefetch\*.pf | Sort-Object LastWriteTime -Descending | Select-Object Name, LastWriteTime

Google's high-throughput full-packet-capture daemon — buffers traffic to disk on a rolling basis so that when an IDS fires, the packets behind the alert can still be pulled minutes or hours later.

Extracts printable character sequences from a binary file — the first, fastest thing to run against any unknown file, from GNU binutils.

strings -n 8 suspicious.bin | less

Community-maintained continuation of Process Hacker — deep process, service, network and driver inspection for live Windows triage, including terminating handles that a normal task manager cannot touch.

The original command-line packet capture/analysis tool, built on libpcap — no GUI, everywhere by default, and still the fastest way to grab a capture on a box with nothing else installed.

tcpdump -i eth0 -w capture.pcap

Captures data transmitted as part of TCP connections and reconstructs each stream into its own file — useful for pulling application-layer content back out of a live capture.

tcpflow -i eth0 -o flows/

Sysinternals GUI showing every active TCP/UDP endpoint with the owning process — a quick live-response check for unexpected outbound connections.

Free partition recovery and repair tool — rebuilds lost partition tables and boot sectors, a first step before deeper forensic imaging of a damaged disk.

testdisk image.dd

Merges failed and successful SSH authentication lines into one chronological view, the fastest way to spot a brute-force run that ends in a successful login.

grep -E 'Failed password|Accepted password' /var/log/auth.log

Google's collaborative timeline-analysis platform — ingests Plaso timelines (and other sources) into a searchable, shareable web UI so a team can annotate and correlate events instead of grepping one giant CSV alone.

A quick awk pipeline that ranks source IPs by request count, the first thing to run on a log suspected of scanning or brute-force traffic.

awk '{print $1}' access.log | sort | uniq -c | sort -rn | head -20

Google's automation framework for running forensic tools (Plaso, bulk_extractor, YARA and more) as a distributed pipeline against cloud-scale evidence, so a large IR engagement is not bottlenecked on one analyst's workstation.

A live-response shell script for Linux, macOS, AIX and Solaris that collects volatile and forensic artifacts (processes, network state, logs, persistence points) into a single archive — the Unix-world counterpart to KAPE.

./uac -p full /tmp/triage

Unofficial iOS backup extractor — pulls an unencrypted or password-known iTunes-style backup off a device and organises it for handoff to iLEAPP or manual review.

Endpoint visibility and DFIR platform — a query language (VQL) for hunting across a fleet of endpoints, collecting artifacts and monitoring in near-real-time rather than imaging one box at a time.

velociraptor -v --config server.config.yaml frontend

A quick way to confirm whether a binary someone dropped is signed and by whom, before deciding whether to trust or detonate it.

certutil -verify -urlfetch payload.exe

codesign confirms whether a binary is signed at all and by whom, and lists exactly what it is entitled to do at runtime.

codesign -dv --verbose=4 /Applications/Suspicious.app
codesign -d --entitlements :- /Applications/Suspicious.app

On a system with module signing enforced, an unsigned loaded module is close to a smoking gun for tampering.

for m in $(lsmod | awk 'NR>1{print $1}'); do modinfo $m | grep -q '^sig_id' || echo "unsigned: $m"; done

The standard open-source memory forensics framework — extracts processes, network connections, injected code and more from a RAM capture across Windows, Linux and macOS.

vol -f memdump.raw windows.pslist

Free GUI front-end for the Volatility memory forensics framework — point-and-click access to plugins for analysts who prefer not to live in the CLI.

A free, open-source XDR/SIEM platform — log analysis, file integrity monitoring, vulnerability detection and rootcheck/rootkit detection from a fleet of lightweight agents, built as an OSSEC fork with a modern stack around it.

Free, open-source Windows memory acquisition tool — dumps physical RAM to a raw or AFF4 image for later Volatility/Rekall/MemProcFS analysis.

winpmem.exe memory.raw

The world's most widely used network protocol analyzer — deep inspection of hundreds of protocols, live capture and offline analysis, with a filter language everyone in the field eventually learns.

wireshark -i eth0 -k

Lightweight, fast commercial disk forensics suite — a long-standing favourite among examiners for its speed and low resource footprint on very large images compared to heavier platforms.

Network forensic analysis tool (NFAT) — reconstructs application-layer content (emails, VoIP calls, HTTP content, chat) from a pcap for post-capture investigation.

A pattern-matching engine purpose-built for malware research — write rules describing families of malicious files, then scan a filesystem or memory image against them at speed.

yara rules.yar suspicious_file

A standalone SIGMA detection engine for EVTX (and Sysmon-for-Linux/auditd JSON) — runs the same Sigma rule set as a SIEM directly against exported logs when there is no SIEM to hand.

python3 zircolite.py --evtx evtx_dir/ --ruleset rules/rules_windows_generic.json