Dissect triage script for Citrix NetScaler devices

A Dissect module implementing a parser for C-like structures.

The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).

A Dissect module implementing a parser for different disk volume and partition systems, for example LVM2, GPT and MBR.

Recordization library

Dissect documentation project

A Dissect module implementing a parser for Microsofts Extensible Storage Engine Database (ESEDB), used for example in Active Directory, Exchange and Windows Update.

Dissect is a digital forensics & incident response framework and toolset that allows you to quickly access and analyse forensic artefacts from various disk and file formats, developed by Fox-IT (part of NCC Group).

PCAP-over-IP server written in Golang

acquire is a tool to quickly gather forensic artifacts from disk images or a live system into a lightweight container.