Screenshots
Example Usage
winget install Microsoft.Git # Copy .vsconfig file or clone the repository and install Visual Studio git clone --recursive https://github.com/dfir-orc/dfir-orc.git cd dfir-orc winget install --id Microsoft.VisualStudio.2022.BuildTools --override "--passive --config .vsconfig" Import-Module "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools\Common7\Tools\Microsoft.VisualStudio.DevShell.dll" Enter-VsDevShell -VsInstallPath "C:\Program Files (x86)\Microsoft Visual Studio\2022\BuildTools" -SkipAutomaticLocation .\Build-Orc.ps1 # Powershell >=5.1
See also
horus
Open Source
An OSINT / digital forensics tool built in Python…
speakeasy
Open Source
Windows kernel and user mode emulation.…
MemProcFS-Analyzer
Open Source
MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR…
PyrsistenceSniper
Open Source
We took PersistenceSniper, merged it with Python, and misspelled it on purpose. Meet PyrsistenceSnip…
detect-lkm-rootkit-cheatsheet
Free
Cheat sheet to detect and remove linux kernel rootkit…
sandfly-setup
Free
Sandfly Security Agentless Compromise and Intrusion Detection System For Linux…