APFS is a proprietary file system developed by Apple for macOS, offering improved performance, security, and reliability.
#file-system tools
24 results
A high-performance digital forensics exploitation tool for extracting structured information from various inputs without parsing file system structures.
CyLR is a Live Response Collection tool for quickly and securely collecting forensic artifacts from hosts with NTFS file systems.
A demonstration of a method to delete a locked executable or currently running file from disk.
A digital forensics tool that provides read-only access to file-system objects from various storage media types and file formats.
A Mac OS X forensic utility for ensuring correct forensic procedures during disk imaging.
A utility for recovering deleted files from ext3 or ext4 partitions.
GVfs is a userspace virtual filesystem implementation for GIO with various backends and features.
An LLM-based honeypot file system creator that generates realistic file systems and configurations to lure attackers and improve analyst engagement.
An open source digital forensic tool for processing and analyzing digital evidence with high performance and multiplatform support.
A library and tools to access and analyze APFS file systems
A library to access the Windows New Technology File System (NTFS) format with read-only support for NTFS versions 3.0 and 3.1.
A library to access FileVault Drive Encryption (FVDE) encrypted volumes on Mac OS X systems.
Utilizing Alternate Data Streams (ADS) to bypass AppLocker default policies by loading DLL/CPL binaries.
View physical memory as files in a virtual file system for easy memory analysis and artifact access.
Review of various MFT parsers used in digital forensics for analyzing NTFS file systems.
A tool for parsing and extracting information from the Master File Table of NTFS file systems.
MFT and USN parser for direct extraction in filesystem timeline format with YARA rule support.
A free, open-source file data recovery software that can recover lost files from hard disks, CD-ROMs, and digital camera memory.
Open source Python library for NTFS analysis
A steganographic file system in userspace for plausible deniability of files.
TestDisk is a free data recovery software that can recover lost partitions and undelete files from various file systems.
TestDisk checks disk partitions and recovers lost partitions, while PhotoRec specializes in recovering lost pictures from digital camera memory or hard disks.
A free, fast, and flexible multi-platform IOC and YARA scanner for Windows, Linux, and macOS.