Popular repositories Loading
-
usnjrnl-forensic
usnjrnl-forensic PublicThe most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery, anti-forensics detection, timestomp…
Rust 31
Repositories
- timeglyph Public
Decode, identify & encode forensic timestamps — every reading ranked, scored, and cited. Rust CLI + library, WASM playground, and a live hover-to-decode overlay.
SecurityRonin/timeglyph’s past year of commit activity - usb-forensic Public
USB device-history forensic correlation engine — reconstructs USB connection history from Windows registry/SetupAPI/event-log/LNK artifacts and scores cross-source timestamp consistency. Pipeline-native, reproducible, panic-free.
SecurityRonin/usb-forensic’s past year of commit activity - browser-forensic Public
Browser forensic library suite — parse Chrome/Firefox/Safari artifacts, detect history clearing, carve deleted records. Single static binary, no runtime deps.
SecurityRonin/browser-forensic’s past year of commit activity - xpress-huffman Public
Pure-Rust, panic-free decompressor for Microsoft Xpress-Huffman ([MS-XCA] §2.2.4) — the codec behind Win10+ prefetch, hiberfil.sys, SMB3 and registry-hive compression. Cross-platform, no Windows API.
SecurityRonin/xpress-huffman’s past year of commit activity - peripheral-forensic Public
External-device connection forensics — parse setupapi.dev.log into a typed DeviceConnection timeline across USB, FireWire, Thunderbolt, PCIe, eSATA, SD; classify DMA-capable vs storage vs HID threat. Pure Rust.
SecurityRonin/peripheral-forensic’s past year of commit activity - leveldb-forensic Public
Read-only forensic LevelDB reader + Chrome Local/Session Storage decoder (recovers deleted records)
SecurityRonin/leveldb-forensic’s past year of commit activity - issen Public
Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/LNK/SRUM/browser/Amcache + memory (processes, netstat, injection), correlates into a DuckDB super-timeline, scans threat-intel, and reports.
SecurityRonin/issen’s past year of commit activity - forensicnomicon Public
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI
SecurityRonin/forensicnomicon’s past year of commit activity - protobuf-forensic Public
Schemaless forensic Protocol Buffers decoder — decode protobuf wire format with no .proto, with field-type heuristics + timeglyph timestamp flagging
SecurityRonin/protobuf-forensic’s past year of commit activity - sqlite-forensic Public
SQLite forensic library — read-only b-tree/freelist/WAL reader plus a deleted-record carver that recovers freed-page, in-page, and dropped-table rows. Panic-free, forbid-unsafe, validated against undark and fqlite.
SecurityRonin/sqlite-forensic’s past year of commit activity
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…