{"repo":"fox-it/dissect","free":true,"listed":false,"github":"https://github.com/fox-it/dissect","clone":"git clone https://github.com/fox-it/dissect.git","description":"Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).","language":null,"stars":1146,"topics":["dfir","dissect","python"],"license":"AGPL-3.0","category":"dev-tools","readme_excerpt":"dissect Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group). This project is a meta package, it will install all other Dissect modules with the right combination of versions. For more information, please see the documentation. What is Dissect? Dissect is an incident response framework build from various parsers and implementations of file formats. Tying this all together, Dissect allows you to work with tools named target-query and target-shell to quickly gain access to forensic artefacts, such as Runkeys, Prefetch files, and Windows Event Logs, just to name a few! Singular approach And the best thing: all in a singular way, regardless of underlying container (E01, VMDK, QCoW), filesystem (NTFS, ExtFS, FFS), or Operating System (Windows, Linux, ESXi) structure / combination. You no longer have to bother extracting files from your forensic container, mount them (in case of VMDKs and such), retrieve the MFT, and parse it using a separate tool, to finally create a timeline to analyse. This is all handled under the hood by Dissect in a user-friendly manner. If we take the example above, you can start analysing parsed MFT entries by just using a command like target-query -f mft ! Create a lightweight container using Acquire Dissect also provides you with a tool called acquire . You can deploy this tool on endpoint(s) to c","default_branch":null,"files":null,"tree":[],"storefront":"/r/fox-it","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/fox-it/dissect/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}