70 open-source Windows & Forensic Artifacts projects

Windows & Forensic Artifacts (File Formats): open-source projects that exist because someone reverse engineered a closed product, sorted by GitHub stars.

1. plaso★ 2,180 · active · Python

   Super-timeline tool with parsers for hundreds of Windows, macOS and app artifacts

2. Dissect★ 1,175 · active · Python

   Forensics framework with parsers for many proprietary disk, file system and artifact formats

3. ALEAPP★ 1,022 · active · Python

   Android Logs, Events and Protobuf Parser for app databases and artifacts

4. evtx (Rust)★ 969 · active · Rust

   Fast, safe Rust parser for the Windows XML Event Log (EVTX) format

5. python-evtx★ 786 · active · Python

   Pure Python parser for Windows XML Event Log (.evtx) files

6. srum-dump★ 766 · active · Python

   Converts the Windows SRUM (System Resource Usage Monitor) database to spreadsheets

7. RegRipper 3.0★ 725 · active · Perl

   Plugin-based extraction of data from Windows registry hives

8. rust-minidump★ 516 · active · Rust

   Rust parser and analyzer for the Microsoft minidump crash file format

9. Python-dsstore★ 510 · dormant · Python

   Parses macOS .DS_Store files and extracts file names

10. python-registry★ 448 · slowing · Python

    Pure Python parser for Windows Registry hive files

11. flare-wmi★ 434 · archived · C++

    Parser and tools for the undocumented WMI CIM repository format

12. evtx (Zimmerman)★ 377 · active · C#

    C# EVTX event log parser with extra maps

13. LECmd★ 350 · active · C#

    Command-line parser for Windows LNK shortcut files

14. MFTECmd★ 342 · active · C#

    Parser for NTFS $MFT, $J, $Boot and $SDS

15. WMI_Forensics★ 320 · dormant · Python

    Scripts to parse the WMI CIM repository for persistence artifacts

16. libewf★ 318 · active · C

    Library for the EnCase Expert Witness Compression Format (EWF/E01) disk images

17. PECmd★ 310 · active · C#

    Windows Prefetch file parser

18. FSEventsParser★ 282 · slowing · Python

    Parser for macOS/iOS FSEvents logs

19. ShimCacheParser★ 279 · archived · Python

    Parses the Windows Application Compatibility Cache from registry hives

20. regipy★ 278 · active · Python

    OS-independent Python library for parsing offline Windows registry hives

21. Registry (Zimmerman)★ 260 · active · C#

    Full-featured offline Windows Registry parser in C#

22. ccl_chromium_reader★ 259 · active · Python

    Python reimplementations of Chromium storage formats for forensics

23. INDXParse★ 229 · slowing · Python

    Tools for NTFS INDX records and other NTFS artifacts

24. liblnk★ 219 · active · C

    Library and tools for the Windows Shortcut (LNK) file format

25. clfs-docs★ 193 · dormant

    Unofficial Common Log File System (CLFS) documentation

26. Thumbcache Viewer★ 172 · dormant · C++

    Extracts images from Windows thumbcache and thumbs.db databases

27. mft (Rust)★ 160 · active · Rust

    Rust parser for the NTFS Master File Table ($MFT)

28. shellbags★ 160 · dormant · Python

    Cross-platform parser for Windows ShellBag registry artifacts

29. etl-parser★ 157 · active · Python

    Pure Python parser for Windows Event Trace Log (ETL) files

30. rifiuti2★ 156 · active · C

    Analyses Windows Recycle Bin INFO2 and $I files

31. BitsParser★ 152 · slowing · Python

    Parses Windows BITS database files and job records

32. LnkParse3★ 147 · active · Python

    Python parser for Windows LNK shortcut files

33. SIDR★ 145 · active · Rust

    Search Index Database Reporter: parses the Windows Search index database

34. yarp★ 143 · dormant · Python

    Yet Another Registry Parser: Windows registry hive parser with transaction log recovery

35. spotlight_parser★ 139 · active · Python

    Reads macOS Spotlight store.db databases

36. AppCompatCacheParser★ 130 · active · C#

    Parser for the Windows AppCompatCache (ShimCache)

37. JLECmd★ 124 · active · C#

    Parser for Windows Automatic and Custom Destinations jump lists

38. forensicsim★ 123 · active · Python

    Autopsy parser extracting Microsoft Teams messages, posts and contacts from its LevelDB stores

39. Windows-Prefetch-Parser★ 123 · slowing · Python

    Parses Windows Prefetch files from XP to Windows 10

40. USN-Journal-Parser★ 119 · dormant · Python

    Python script to parse the NTFS USN change journal

41. Lnk★ 100 · active · C#

    C# library for parsing Windows LNK shortcut files

42. ds_store★ 96 · active · Python

    Python library to read and write Finder .DS_Store files

43. libscca★ 90 · active · C

    Library and tools for the Windows Prefetch (SCCA) file format

44. libfwsi★ 75 · active · C

    Library for the Windows Shell Item format used in ShellBags and LNK files

45. bits_parser★ 74 · slowing · Python

    Extracts BITS jobs from Windows QMGR queue files

46. libevt★ 60 · active · C

    Library and tools for the legacy Windows Event Log (EVT) format

47. libfwnt★ 58 · active · C

    Library for Windows NT data types including LZXPRESS Huffman decompression

48. libmdmp★ 45 · active · C

    Library and tools for the Windows Minidump (MDMP) format

49. ExtensionBlocks★ 26 · active · C#

    Parser for shell item extension blocks found in ShellBags

50. mac_alias★ 26 · active · Python

    Generates and parses macOS Alias and Bookmark records in Python

51. RustyUsn★ 22 · dormant · Rust

    Rust parser that converts NTFS USN journal records to JSON

52. go-prefetch★ 20 · active · Go

    Go parser for Windows Prefetch files

53. regparser★ 20 · slowing · Go

    Go parser for Windows registry hives

54. libfwevt★ 18 · active · C

    Library for Windows XML Event Log (EVTX) binary XML data types

55. libmsiecf★ 18 · active · C

    Library for Internet Explorer cache (index.dat) files

56. libwtcdb★ 16 · active · C

    Library for the Windows Explorer thumbnail cache database (thumbcache) format

57. libagdb★ 13 · active · C

    Library for the Windows SuperFetch database format

58. libftxf★ 8 · active · C

    Library for Transactional NTFS (TxF) data types

59. libmapidb★ 7 · active · C

    Library for the Exchange MAPI database format

60. libfwps★ 6 · active · C

    Library for Windows Property Store data types

61. dissect.cim★ 5 · active · Python

    Python parser for the Windows WMI CIM repository database

62. dissect.etl★ 5 · active · Python

    Python parser for Windows Event Trace Log (ETL) files

63. libcreg★ 5 · active · C

    Library for the Windows 9x/Me registry (CREG) file format

64. dissect.regf★ 4 · active · Python

    Python parser for the Windows registry hive format

65. libnk2★ 4 · active · C

    Library for the Microsoft Outlook Nickfile (NK2) format

66. libwrc★ 4 · active · C

    Library for the Windows Resource Compiler (WRC) resource format

67. dissect.shellitem★ 3 · active · Python

    Python parser for Windows Shell Item structures

68. dissect.thumbcache★ 3 · active · Python

    Python parser for Windows thumbcache databases

69. libpst★ 0

    Library and readpst tool for reading Microsoft Outlook PST files

70. msitools★ 0

    Tools to inspect and build Windows Installer (.MSI) files on Linux