Hands-on projects for beginners to learn and practice Windows forensics and essential cybersecurity skills
-
Updated
Jun 29, 2024
#
windows-forensics
Here are 40 public repositories matching this topic...
Language: All
Filter by language
Sort: Most stars
Sort options
Cross-platform registry browser for raw Windows registry files
-
Updated
Apr 15, 2023 - Python
ExeSpy is a cross-platform PE viewer for EXE and DLL files
-
Updated
Feb 19, 2025 - Python
Windows forensics Engine
-
Updated
Feb 16, 2026 - Python
Vault of Windows Registry forensic artifacts
-
Updated
Nov 12, 2025 - JavaScript
A DFIR Incident Response AI bot using local Ollama LLM to derrive automated findings from logs
incident-response dfir digital-forensics triage live-response windows-forensics forensics-tools llm ollama dfirvault ir-tools dfir-ai dfir-llm
-
Updated
Jan 17, 2026 - Python
Tools and Techniques for Digital Forensics and Incident Response
incident-response dfir digital-forensics digital-forensics-incident-response windows-forensics linux-forensics
-
Updated
Feb 16, 2026
Command Spy is a utility for monitoring the command line arguments of new processes on Windows. Made for CCDC.
-
Updated
Jul 30, 2023 - C#
Python module for forensic analysis of Windows shortcuts (LNK files). You can install this package using pip install lnkanalyser
-
Updated
Mar 28, 2024 - Python
A comprehensive MCP server for Windows digital forensics on KALI Linux
-
Updated
Feb 17, 2026 - YARA
A comprehensive repository for CyberOps documentation, Blue Team playbooks, and open-source forensic tools like Cerberus and Chimera.
powershell incident-response forensics dfir cybersecurity threat-hunting digital-forensics triage blueteam memory-forensics security-tools threat-detection live-response windows-forensics memory-acquisition linux-forensics kusto-query incident-response-tool
-
Updated
Jan 21, 2026
When conducting an investigation on a Windows machine there are 8 phase to go through, today we’ll discuss the first ‘Collecting Volatile Information’, and the rest will be explained in future topics
windows forensics cybersecurity cyber-security investigation windows-forensics forensics-tools sans500 cyberred
-
Updated
Sep 24, 2023
AWMFA - Automated Windows Memory Forensics Analysis. Python automation framework for Volatility 2 that streamlines memory analysis. Features: automated plugin execution with threading, intelligent threat detection using 28+ heuristics, no deep Windows internals knowledge required, multi-format reports (TXT/HTML/PDF).
incident-response dfir cybersecurity malware-analysis digital-forensics memory-analysis automated-analysis volatility forensic-analysis memory-forensics security-tools incident-response-tooling dfir-automation windows-forensics forensics-tools windows-memory dfir-tools
-
Updated
Nov 8, 2025 - Python
RDP Bitmap Cache Praser A lightweight forensic utility to extract and reconstruct images from the RDP Bitmap Cache (bmc, bin, dat) files. Useful for identifying visual remnants of a remote desktop session, even after it ends. Ideal for forensic investigations and RDP activity analysis.
-
Updated
May 28, 2025 - Python
Blue-team portfolio: SOC detection engineering, malware analysis, vulnerability management.
cybersecurity sysmon malware-analysis blue-team kql detection-engineering velociraptor windows-forensics microsoft-sentinel
-
Updated
Feb 12, 2026
EVTX triage and investigation tool for Windows event log analysis, timeline reconstruction and incident response.
log-analysis timeline incident-response dfir digital-forensics soc security-analysis blue-team evtx windows-event-logs windows-forensics security-investigation
-
Updated
Feb 11, 2026 - HTML
From Shadows to Sun: A high-resolution forensics suite for absolute coordinate determination, from triage to testimony.
python incident-response dfir threat-hunting digital-forensics mft sigma-rules windows-forensics polars forensics-analysis
-
Updated
Jan 25, 2026 - Python
FAEP is an automated tool to extract and parse forensic artifacts from .E01 images automatically, with a clean GUI and minimal manual effort.
prefetch hindsight dfir digital-forensics windows-registry e01 amcache browser-forensic dfir-automation windows-forensics srum-db
-
Updated
Jun 22, 2025 - Perl
Understanding what forensic artifacts are present in the Windows and Linux Operating Systems, how to collect them, and leverage them to investigate security incidents.
dfir malware-analysis volatility memory-forensics redline thehive-project kape velociraptor tryhackme windows-forensics tryhackme-writeups linux-forensics tryhackme-answers autopsy-gui registry-forensics registry-explorer
-
Updated
Nov 7, 2025
Search artifact paths, build collection scripts, and convert Sigma rules. All in one place.
incident-response forensics artifacts digital-forensics forensic-analysis artefacts forensics-investigations windows-forensics forensics-tools
-
Updated
Feb 16, 2026 - TypeScript
Improve this page
Add a description, image, and links to the windows-forensics topic page so that developers can more easily learn about it.
Add this topic to your repo
To associate your repository with the windows-forensics topic, visit your repo's landing page and select "manage topics."