Skip to content
DigitalForenSeek home

Tools

Open-source DFIR tools for evidence-driven investigations.

A growing set of open-source tools for digital forensics and incident response. Each one is scriptable, built for real casework, and documented from its own source code.

Quick start

Run a tool from the command line. For example, parse a Windows event log with EventHawk and save the results as JSON (from a source install): 

py -3 evtx_tool.py parse C:\Logs\Security.evtx --output results.json

Tools

5 tools

  • EventHawk

    Version v1.3.0 License: Apache-2.0

    Windows Event Log (EVTX) analysis for DFIR: parallel parsing, DFIR profiles, ATT&CK mapping, IOC extraction and timelines.

    • Windows
    • DFIR

  • Prefetch Parser

    Version v0.9.0 License: MIT

    Cross-platform Windows Prefetch (.pf) parser with a command line and a GUI.

    • Windows
    • Forensics

  • PhonePe Android Forensics

    License: MIT

    Offline, read-only analyser that rebuilds PhonePe Android app data into a unified timeline.

    • Android
    • Mobile

  • Paytm Forensics

    Version v0.1.0

    Offline, read-only forensic parser for data acquired from the Paytm Android app.

    • Android
    • Mobile

  • WhatsApp Web Extractor

    Version v1.1.0 License: Apache-2.0

    Forensic export of WhatsApp Web data from a browser profile on disk.

    • Browser
    • Forensics

About

DigitalForenSeek publishes practical, open-source tooling for DFIR work. Documentation on this site is written from each tool’s repository; anything the source does not confirm is marked as pending rather than guessed. Source code, issues and releases live on GitHub.