SecurityRonin repositories

123 repositories

forensicnomicon
Public
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offli…
rust persistence incident-response
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara
Rust
•
Apache License 2.0
•2•7•0•0•Updated Oct 6, 2026Oct 6, 2026
chat4n6
Public
Forensic extraction for WhatsApp, Signal, and Telegram — 8-layer SQLite recovery, anti-forensics detection, court-ready reports.
rust incident-response dfir
rust incident-response dfir digital-forensics signal-forensics ios-forensics android-forensics sqlite-forensics whatsapp-forensics deleted-message-recovery
Rust
•
MIT License
•6•45•1•4•Updated Sep 28, 2026Sep 28, 2026
homebrew-tap
Public
Homebrew formulae for Security Ronin tools
Ruby
•0•0•0•0•Updated Sep 28, 2026Sep 28, 2026
peira
Public
A knowledge system that refuses to promote a claim you have not examined — with gates drawn from Socratic elenchus, 金剛經, Nyāya, Madhyamaka and the causal ladder…
Rust
•
Apache License 2.0
•0•0•13•0•Updated Sep 28, 2026Sep 28, 2026
timeglyph
Public
Decode, identify & encode forensic timestamps — every reading ranked, scored, and cited — plus a timezone/DST/leap-aware reference calendar for interpreting the…
timeline datetime calendar
timeline datetime calendar timezone holidays timestamp filetime leap-seconds
Rust
•
Apache License 2.0
•0•6•0•1•Updated Sep 25, 2026Sep 25, 2026
ios-backup-forensic
Public
Native, read-only, panic-free reader and anomaly auditor for iOS device backups (Finder / iTunes / MobileSync), including encrypted backups.
rust ios forensics
rust ios forensics dfir digital-forensics itunes-backup ios-backup mobile-forensics
Rust
•
Other
•0•0•0•1•Updated Sep 24, 2026Sep 24, 2026
ronin-issen
Public
The SecurityRonin forensic fleet — 86 pure-Rust DFIR libraries fronted by Issen: point it at a disk image + memory dump, get one correlated ATT&CK-mapped timeli…
rust timeline incident-response
rust timeline incident-response forensics dfir digital-forensics memory-forensics mitre-attack disk-forensics attack-flow
Python
•
Apache License 2.0
•0•6•2•0•Updated Sep 21, 2026Sep 21, 2026
btrfs-forensic
Public
Btrfs forensic library — parse superblock/chunk-tree/fs-tree/extents, detect integrity anomalies, carve deleted files via CoW backup roots. Pure-Rust, panic-fre…
Rust
•
Apache License 2.0
•0•0•0•0•Updated Sep 21, 2026Sep 21, 2026
ntfs-forensic
Public
From-scratch NTFS reader (ntfs-core: MFT, attributes, indexes, data runs, LZNT1, $UsnJrnl:$J change journal over Read+Seek) plus a graded anomaly auditor (ntfs-…
rust security filesystem
rust security filesystem incident-response forensics dfir ntfs digital-forensics anti-forensics mft
Rust
•
Apache License 2.0
•2•1•6•4•Updated Sep 21, 2026Sep 21, 2026
shellitem
Public
Windows Shell Item / ITEMIDLIST (PIDL) parser — decode .lnk LinkTargetIDList and registry ShellBags into typed items + a reconstructed path. A reusable forensic…
windows rust incident-response
windows rust incident-response forensics dfir shell-item pidl itemidlist
Rust
•
Apache License 2.0
•0•0•0•1•Updated Sep 20, 2026Sep 20, 2026
4n6mount
Public
Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4, AD1, zip/7z/tar, LiME…
windows rust fuse
windows rust fuse dokan filesystem incident-response forensics dfir disk-image ntfs
Rust
•
Apache License 2.0
•0•11•1•0•Updated Sep 20, 2026Sep 20, 2026
journald-forensic
Public
From-scratch systemd journal (.journal) forensic reader — parse entries without journalctl/systemd, carve from unallocated space, and flag tampering (sequence g…
linux rust security
linux rust security log-analysis systemd incident-response forensics dfir journald anti-forensics
Rust
•
Apache License 2.0
•0•0•0•0•Updated Sep 20, 2026Sep 20, 2026
discord-desktop-forensic
Public
Discord desktop forensic parser — recover account/token/cached channels+messages from Chromium LevelDB. Token redacted by default. Panic-free by lint.
rust discord messenger
rust discord messenger incident-response chromium forensics dfir digital-forensics
Rust
•
Apache License 2.0
•0•1•0•0•Updated Sep 20, 2026Sep 20, 2026
sqlite-forensic
Public
Read-only SQLite forensic toolkit: carve deleted records (freelist/in-page/dropped-table/WAL/journal), read index b-trees & WITHOUT ROWID tables, WAL version hi…
rust sqlite incident-response
rust sqlite incident-response sqlcipher forensics dfir python-bindings digital-forensics btree wal
Rust
•
Apache License 2.0
•0•4•0•0•Updated Sep 20, 2026Sep 20, 2026
chromium-storage-forensic
Public
Chromium storage forensic readers — decode Simple Cache, IndexedDB-over-LevelDB (V8/Blink values), and Local Storage from Chromium profiles. Panic-free by lint,…
rust chrome leveldb
rust chrome leveldb incident-response chromium forensics dfir indexeddb digital-forensics browser-forensics
Rust
•
Apache License 2.0
•0•0•0•1•Updated Sep 20, 2026Sep 20, 2026
state-history-forensic
Public
State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No…
rust incident-response forensics
rust incident-response forensics dfir digital-forensics temporal state-history
Rust
•
Apache License 2.0
•0•0•0•0•Updated Sep 20, 2026Sep 20, 2026
forensic-vfs-mount
Public
Rust
•
Apache License 2.0
•0•0•0•0•Updated Sep 20, 2026Sep 20, 2026
exec-pe-forensic
Public
PE (Windows executable) forensic analyzer — pe-core parses PE32/PE64 headers (sections, imports, entropy); pe-analysis grades MITRE-tagged anomalies (suspicious…
windows rust security
windows rust security incident-response forensics dfir malware-analysis pe portable-executable mitre-attack
Rust
•
Apache License 2.0
•0•1•0•0•Updated Sep 20, 2026Sep 20, 2026
ewf-forensic
Public
Forensic integrity analysis and repair for EWF (Expert Witness Format / E01) images
rust forensics dfir
rust forensics dfir digital-forensics e01 ewf tampering-detection integrity-checking
Rust
•
Apache License 2.0
•2•0•0•6•Updated Sep 20, 2026Sep 20, 2026
iso9660-forensic
Public
Forensic ISO 9660 reader & tamper analyzer in pure Rust — analyse() surfaces 23 anomaly findings (redundancy, slack, EDC/ECC, concealment) across multi-session,…
rust security parser
rust security parser iso incident-response forensics dfir file-format disk-image udf
Rust
•
Apache License 2.0
•1•1•0•1•Updated Sep 20, 2026Sep 20, 2026
apfs-forensic
Public
Apple File System (APFS) forensic library — from-scratch pure-Rust reader (apfs-core) + anomaly analyzer (apfs-forensic) for container, volume, snapshot, encryp…
macos rust incident-response
macos rust incident-response forensics dfir file-system digital-forensics apfs filesystem-forensics apple-file-system
Rust
•
Apache License 2.0
•0•0•0•1•Updated Sep 20, 2026Sep 20, 2026
forensic-vfs
Public
Read-only forensic VFS contracts composing evidence into one positioned-read byte edge — ArchiveOpen · ContainerOpen · VolumeSystemOpen · EncryptionOpen · FileS…
rust encryption filesystem
rust encryption filesystem incident-response forensics dfir archive vfs disk-image ntfs
Rust
•
Apache License 2.0
•0•0•0•1•Updated Sep 20, 2026Sep 20, 2026
zfs-forensic
Public
ZFS forensic library — parse ZFS on-disk (vdev labels, uberblock, block pointers, DMU/dnode, ZAP/DSL/ZPL/SA), detect anomalies, carve deleted files via snapshot…
Rust
•
Apache License 2.0
•0•3•0•0•Updated Sep 20, 2026Sep 20, 2026
ufs-forensic
Public
UFS/FFS forensic library — parse UFS1/UFS2 (superblock, cylinder groups, inodes, directories, indirect blocks), detect anomalies, carve deleted files. Pure-Rust…
Rust
•
Apache License 2.0
•0•0•0•0•Updated Sep 20, 2026Sep 20, 2026
udf-forensic
Public
Forensic-grade UDF (ECMA-167/OSTA) reader — volume recognition, partition maps, File Entry/FID traversal, file data
Rust
•
Apache License 2.0
•1•1•0•0•Updated Sep 20, 2026Sep 20, 2026
xfs-forensic
Public
XFS forensic library — parse XFS (superblock, AG headers, inodes, bmbt extents, directories), detect integrity anomalies, carve deleted inodes. Pure-Rust, panic…
Rust
•
Apache License 2.0
•0•2•0•0•Updated Sep 20, 2026Sep 20, 2026
ext4fs-forensic
Public
Forensic-grade ext4 filesystem parser — pure safe Rust, MIT licensed. Deleted file recovery, journal parsing, timeline generation, slack space analysis, and mor…
rust ext4 filesystem
rust ext4 filesystem incident-response forensics dfir mit-license digital-forensics file-recovery timeline-analysis
Rust
•
Apache License 2.0
•0•0•1•0•Updated Sep 20, 2026Sep 20, 2026
hfsplus-forensic
Public
Forensic-grade Apple HFS+/HFSX reader — volume header, catalog B-tree directory listing, and data-fork file extraction
Rust
•
Apache License 2.0
•0•0•0•0•Updated Sep 20, 2026Sep 20, 2026
cryptlab
Public
CryptLab — crack classical ciphers yourself: Caesar, Vigenère & frequency analysis. Hands-on cryptography teaching tool.
HTML
•
MIT License
•0•1•0•0•Updated Sep 12, 2026Sep 12, 2026
browser-forensic
Public
Parse Chrome/Firefox/Safari and embedded-Chromium app artifacts — history, cookies, web storage, integrity/tampering, free-page carving, container discovery — i…
electron rust cli
electron rust cli firefox chrome sqlite leveldb incident-response safari chromium
Rust
•
Apache License 2.0
•0•3•0•0•Updated Aug 26, 2026Aug 26, 2026

ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.

Navigation Menu

Security Ronin

All

123 repositories

forensicnomicon

chat4n6

homebrew-tap

peira

timeglyph

ios-backup-forensic

ronin-issen

btrfs-forensic

ntfs-forensic

shellitem

4n6mount

journald-forensic

discord-desktop-forensic

sqlite-forensic

chromium-storage-forensic

state-history-forensic

forensic-vfs-mount

exec-pe-forensic

ewf-forensic

iso9660-forensic

apfs-forensic

forensic-vfs

zfs-forensic

ufs-forensic

udf-forensic

xfs-forensic

ext4fs-forensic

hfsplus-forensic

cryptlab

browser-forensic

Repositories list

123 repositories