Skip to content

@fox-it Fox-IT

All

    Repositories list

    98 repositories

    • citrix-netscaler-triage

      Public
      Dissect triage scripts for Citrix NetScaler devices
      dfirnetscaleriocs
      dfirnetscaleriocscitrixwebshellsdissectcve-2023-3519cve-2025-5777cve-2025-7775cve-2025-6543
      Python
      •
      Apache License 2.0
      •19•74•0•0•Updated Oct 2, 2026Oct 2, 2026

    • dissect.cobaltstrike

      Public
      Python library for dissecting and parsing Cobalt Strike related data such as Beacon payloads and Malleable C2 Profiles
      pythonparserpcap
      pythonparserpcappython3beaconpypy3malleable-c2-profilecobaltstrikedissect
      Python
      •
      MIT License
      •27•198•0•0•Updated Oct 1, 2026Oct 1, 2026

    • cisco-ios-xe-implant-detection

      Public
      Cisco IOS XE implant scanning & detection (CVE-2023-20198, CVE-2023-20273)
      pcapciscosuricata
      pcapciscosuricatacisco-ios-xecve-2023-20198cve-2023-20273iociscobadcandy
      Python
      •
      Apache License 2.0
      •9•41•0•0•Updated Sep 30, 2026Sep 30, 2026

    • dissect.cstruct

      Public
      A Dissect module implementing a parser for C-like structures.
      Python
      •
      Apache License 2.0
      •24•68•11•5•Updated Sep 25, 2026Sep 25, 2026

    • dissect.target

      Public
      The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data source…
      Python
      •
      GNU Affero General Public License v3.0
      •100•93•366•125•Updated Sep 25, 2026Sep 25, 2026

    • dissect.fve

      Public
      A Dissect module implementing a parsers for full volume encryption implementations, currently Microsoft's Bitlocker Disk Encryption (BDE) and Linux Unified Key …
      Python
      •
      GNU Affero General Public License v3.0
      •4•8•1•0•Updated Sep 24, 2026Sep 24, 2026

    • dissect

      Public
      Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and …
      pythondfirdissect
      pythondfirdissect
      GNU Affero General Public License v3.0
      •89•1.2k•10•3•Updated Sep 24, 2026Sep 24, 2026

    • dissect.evidence

      Public
      A Dissect module implementing a parsers for various forensic evidence file containers, currently: AD1, ASDF and EWF.
      Python
      •
      GNU Affero General Public License v3.0
      •6•11•10•4•Updated Sep 2, 2026Sep 2, 2026

    • python-build-pystandalone

      Public
      Produce redistributable builds of Python
      Python
      •
      Mozilla Public License 2.0
      •320•0•0•14•Updated Sep 2, 2026Sep 2, 2026

    • dissect.database

      Public
      A Dissect module implementing parsers for various database formats
      Python
      •
      Apache License 2.0
      •10•5•14•6•Updated Aug 27, 2026Aug 27, 2026

    • dissect.util

      Public
      A Dissect module implementing various utility functions for the other Dissect modules.
      Python
      •
      Apache License 2.0
      •14•5•17•14•Updated Aug 27, 2026Aug 27, 2026

    • acquire

      Public
      acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.
      Python
      •
      GNU Affero General Public License v3.0
      •42•122•42•17•Updated Aug 12, 2026Aug 12, 2026

    • dissect.shellitem

      Public
      A Dissect module implementing a parser for the Shellitem structures, commonly used by Microsoft Windows.
      Python
      •
      GNU Affero General Public License v3.0
      •4•3•0•1•Updated Aug 10, 2026Aug 10, 2026

    • dissect.volume

      Public
      A Dissect module implementing a parser for different disk volume and partition systems, for example LVM2, GPT and MBR.
      Python
      •
      GNU Affero General Public License v3.0
      •4•5•3•2•Updated Jul 30, 2026Jul 30, 2026

    • dissect.hypervisor

      Public
      A Dissect module implementing parsers for various hypervisor disk, backup and configuration files.
      Python
      •
      GNU Affero General Public License v3.0
      •15•12•11•6•Updated Jul 28, 2026Jul 28, 2026

    • dissect.etl

      Public
      A Dissect module implementing a parser for Event Trace Log (ETL) files, used by the Windows operating system to log kernel events.
      Python
      •
      GNU Affero General Public License v3.0
      •5•5•3•2•Updated Jul 27, 2026Jul 27, 2026

    • dissect.cim

      Public
      A Dissect module implementing a parser for the Windows Common Information Model (CIM) database, used in the Windows operating system.
      Python
      •
      GNU Affero General Public License v3.0
      •6•5•3•1•Updated Jul 27, 2026Jul 27, 2026

    • dissect.eventlog

      Public
      A Dissect module implementing parsers for the Windows EVT, EVTX and WEVT log file formats.
      Python
      •
      GNU Affero General Public License v3.0
      •5•7•3•2•Updated Jul 23, 2026Jul 23, 2026

    • dissect.executable

      Public
      A Dissect module implementing parsers for various executable formats such as PE, ELF and Macho-O.
      Python
      •
      GNU Affero General Public License v3.0
      •5•4•6•4•Updated Jul 17, 2026Jul 17, 2026

    • flow.record

      Public
      Recordization library
      Python
      •
      GNU Affero General Public License v3.0
      •17•11•14•12•Updated Jul 10, 2026Jul 10, 2026

    • dissect.disc

      Public
      A Dissect module implementing a parser for file systems commonly used on optical media, such as ISO9660 and several extensions.
      Python
      •
      GNU Affero General Public License v3.0
      •2•0•0•0•Updated Jul 4, 2026Jul 4, 2026

    • dissect-docs

      Public
      Dissect documentation project
      GNU Affero General Public License v3.0
      •8•7•13•5•Updated Jun 23, 2026Jun 23, 2026

    • dissect.apfs

      Public
      Dissect module implementing a parser for the APFS file system, a commonly used Apple filesystem
      Python
      •
      GNU Affero General Public License v3.0
      •2•7•0•0•Updated Jun 18, 2026Jun 18, 2026

    • dissect.regf

      Public
      A Dissect module implementing a parser for Windows registry file format, used to store application and OS configuration on Windows operating systems.
      Python
      •
      GNU Affero General Public License v3.0
      •6•4•2•0•Updated Jun 10, 2026Jun 10, 2026

    • dissect.fat

      Public
      A Dissect module implementing parsers for the FAT and exFAT file systems, commonly used on flash memory based storage devices and UEFI partitions.
      Python
      •
      GNU Affero General Public License v3.0
      •5•6•3•2•Updated Jun 4, 2026Jun 4, 2026

    • pystandalone

      Public
      0•2•5•1•Updated Apr 28, 2026Apr 28, 2026

    • dissect.qnxfs

      Public
      A Dissect module implementing a parser for the QNX4 and QNX6 file systems, commonly used in the QNX RTOS.
      Python
      •
      GNU Affero General Public License v3.0
      •3•0•0•0•Updated Mar 30, 2026Mar 30, 2026

    • dissect.squashfs

      Public
      A Dissect module implementing a parser for the SquashFS file system.
      Python
      •
      GNU Affero General Public License v3.0
      •3•2•6•0•Updated Mar 27, 2026Mar 27, 2026

    • dissect.ntfs

      Public
      A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system.
      Python
      •
      GNU Affero General Public License v3.0
      •8•11•9•3•Updated Mar 27, 2026Mar 27, 2026

    • dissect.ole

      Public
      A Dissect module implementing a parser for the Object Linking & Embedding (OLE) format, commonly used by document editors on Windows operating systems.
      Python
      •
      GNU Affero General Public License v3.0
      •3•4•2•0•Updated Mar 27, 2026Mar 27, 2026
    ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.