mkucenski Goto Github PK

datatime

A recreation of of The SleuthKit's 'mactime' with a goal of of faster results and allowing integration of timeline data from other sources (EVT, LNK, Firewall, etc.)

easy-rsa

easy-rsa - Simple shell based CA utility

fluent-plugin-winevtx-xml-nxt

Update Fluentd Parser plugin to parse XML rendered windows event log with EventData Records and Other Features

hpacontrol

FreeBSD/Linux application for manipulating disk Host Protected Areas (out-of-date, untested)

libbindata

Internal library used for parsing binary data

libdelimtext

Internal library used for parsing delimited text data

libdfxml

libntfssecure

libntfsusnjrnl

Library for parsing Windows Change Journal records (aka USN Journal).

libpasswdfile

Library for parsing passwd/group files (also supports Windows via Cygwin 'mkpasswd' command).

libtimeutils

libusbinfo

FreeBSD/Linux library for accessing USB devices (out-of-date, untested)

libwinevt

Library for accessing Windows Event Log (.EVT) files.

libwinlnk

Library for accessing Windows Shortcut (.LNK) files.

libwinmft

mactimerecover

misc

Misc. shared header files

multi2mactime

Utility to massage various log/text data into The Sleuthkit's mactime/body format to conduct comparative analysis between various sources of records.

netwhoislookup

Python-based "Smart" Whois client and libraries for identifying large numbers of IP addresses (out-of-date, untested)

networkmonitor

A set of Linux scripts for targeted collection of trap/trace or full packet network data.

scripts

Misc scripts

smartdns

smartwhois

The idea here is to create an intelligent interface to the world of "WHOIS" that digs deep to get the most accurate/specific information and returns results in a normalized, JSON format.

usbinfo

FreeBSD/Linux application for accessing USB devices (out-of-date, untested)

winevtviewer

Command-line viewer for Windows Event Log Files (.EVT)

winlnkviewer

Command-line viewer for Windows Shortcut Files (.LNK)

winusnjrnlviewer