germanoeich/SearchSharp

Language: C# - Size: 33.2 KB - Last synced: about 2 months ago - Pushed: over 6 years ago - Stars: 3 - Forks: 1

kero99/mftmactime

MFT and USN parser that allows direct extraction in filesystem timeline format (mactime), dump all resident files in the MFT in their original folder structure and run yara rules over them all.

Language: Python - Size: 32.2 KB - Last synced: 4 months ago - Pushed: about 1 year ago - Stars: 9 - Forks: 2

evild3ad/Get-UsnJrnlInfo

Get-UsnJrnlInfo - Get UsnJrnl Information from extracted $Max file

Language: PowerShell - Size: 229 KB - Last synced: 8 months ago - Pushed: over 2 years ago - Stars: 3 - Forks: 2