Popular repositories Loading
-
usnjrnl-forensic
usnjrnl-forensic PublicThe most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery, anti-forensics detection, timestomp…
Rust 31
Repositories
- qcow2-forensic Public
Pure-Rust QCOW2 forensics: reader (qcow2-core) + anomaly auditor (qcow2-forensic) — backing files, snapshots, encryption, refcount orphans on the forensicnomicon report model
SecurityRonin/qcow2-forensic’s past year of commit activity - ewf-forensic Public
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
SecurityRonin/ewf-forensic’s past year of commit activity - blazehash Public
Forensic file hasher — BLAKE3 at 1,640 MB/s, 25 hash algorithms, Ed25519 + post-quantum signing, Bitcoin timestamps, YARA scanning, 50+ remote backends. hashdeep for the modern era.
SecurityRonin/blazehash’s past year of commit activity - lzvn Public
Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).
SecurityRonin/lzvn’s past year of commit activity - udf-forensic Public
Forensic-grade UDF (ECMA-167/OSTA) reader — volume recognition, partition maps, File Entry/FID traversal, file data
SecurityRonin/udf-forensic’s past year of commit activity - shellitem Public
Windows Shell Item / ITEMIDLIST (PIDL) parser — decode .lnk LinkTargetIDList and registry ShellBags into typed items + a reconstructed path. A reusable forensic primitive. Pure Rust.
SecurityRonin/shellitem’s past year of commit activity - vhdx-forensic Public
Pure-Rust VHDX (Hyper-V) virtual-disk reader and forensic integrity analyzer: a hardened Read+Seek container reader (vhdx-core) plus a 63-code tamper/anomaly auditor with in-memory repair (vhdx-forensic) for DFIR.
SecurityRonin/vhdx-forensic’s past year of commit activity - usb-forensic Public
USB device-history correlation engine — reconstructs USB connection history from every Windows artifact (registry, SetupAPI, event logs, LNK) plus macOS/Linux, and scores cross-source timestamp consistency by tamper-independence. Runs headless on any OS; pipeline-native JSONL, reproducible, panic-free.
SecurityRonin/usb-forensic’s past year of commit activity - timeglyph Public
Decode, identify & encode forensic timestamps — every reading ranked, scored, and cited — plus a forensic calendar (DST, leap seconds, GPS week, format epochs, moon phase). Rust CLI + library, WASM playground, and a live hover-to-decode overlay.
SecurityRonin/timeglyph’s past year of commit activity - shellhist-forensic Public
Shell command-history forensic library suite — parse bash, zsh, fish, and PowerShell PSReadLine history; detect history clearing, back-dated entries, and download-pipe-to-shell. Pure Rust, no runtime deps.
SecurityRonin/shellhist-forensic’s past year of commit activity
People
This organization has no public members. You must be a member to see who’s a part of this organization.
Top languages
Loading…
Most used topics
Loading…