This curated collection brings together scripts for live response, evidence collection, log and timeline analysis, and filesystem examination. Each tool includes a short summary and a direct link to its source on GitHub.
Before use: review the script, its dependencies and its effect on the target system. Several tools require root privileges or third-party forensic utilities. Use them only on systems and evidence that you are authorised to examine.
Browse the complete Bash collection on GitHub (opens in a new tab).
Collect volatile evidence and investigate activity on live Linux hosts and container platforms.
Recovers executables and executable memory regions from live Linux processes, including deleted and memory-backed files, with hashes and structured manifests.
Requirements: Requires root privileges and access to the target process through /proc.
View Process Recovery on GitHub (opens in a new tab)Performs rapid checks of offline systemd journals for authentication activity, privileged commands and other investigative leads.
Requirements: Requires root privileges and a directory containing systemd journal files; findings should be reviewed in context.
View Operating System Journal Triage on GitHub (opens in a new tab)Collects key authentication, system, audit and journal logs from multiple Linux hosts over SSH.
Requirements: Requires suitable SSH access and must be tested against the responder's environment before operational use.
View Rapid Log Grabber on GitHub (opens in a new tab)Captures Docker host, image and container information to support incident triage in containerised environments.
Requirements: Requires Docker and a writable output directory with sufficient space for the collected artefacts.
View Docker Triage on GitHub (opens in a new tab)Records a process's namespace and mount context before recovering its executable through the process root, an open /proc handle or executable memory regions.
Requirements: Requires root privileges, a live process ID and kernel permission to read the relevant /proc entries.
View Namespace-Aware Executable Recovery on GitHub (opens in a new tab)Collects system-wide and per-user cron definitions into CSV output to support scheduled-task and persistence review.
Requirements: Requires root privileges and should be tested against the target distribution because it is supplied as a demonstration script.
View Cron Artefact Collector on GitHub (opens in a new tab)Summarises successful and failed password authentications found in common Debian, Ubuntu and Red Hat log locations.
Requirements: Reviews fixed auth.log and secure paths, including one rotated file, and does not cover every authentication method.
View Authentication Log Check on GitHub (opens in a new tab)Recovers a single process executable through /proc, recording its link target, metadata, file type and SHA-256 hashes.
Requirements: Requires root privileges, a live process ID and readable access to the process's executable handle.
View Deleted Process Executable Recovery on GitHub (opens in a new tab)Uses GDB to extract the readable and writable private memory regions associated with a running Linux process.
Requirements: Requires GDB and permission to attach to the process; debugger attachment may briefly affect process behaviour.
View Process Memory Dumper on GitHub (opens in a new tab)Hunts for indicators associated with the ShadowHS fileless post-exploitation framework, including memory-backed execution, command-line spoofing, tunnelling and mining activity.
Requirements: Requires root privileges. It is threat-specific and its findings are investigative leads that may include false positives.
View ShadowHS Live Hunter on GitHub (opens in a new tab)Convert, triage and compare Linux logs and forensic timelines across one or more systems.
Converts offline systemd journal files into merged text and CSV output for easier searching, review and ingestion.
Requirements: Requires journalctl and Python 3; gzip or xz is optional for compressed output.
View Systemd Journal Converter on GitHub (opens in a new tab)Runs Plaso timeline processing across collections of forensic images and records each result in a CSV manifest.
Requirements: Requires psteal.py and zstd; review the parser selection and output paths before use.
View Bulk Plaso Runner on GitHub (opens in a new tab)Extracts and ranks shell-history commands across multiple disk images to highlight common or unusual activity.
Requirements: Requires Dissect's target-query utility and jq.
View Bash History Stack on GitHub (opens in a new tab)Extracts bodyfiles from batches of UAC archives in preparation for filesystem timeline analysis.
Requirements: Expects UAC tar.gz archives containing bodyfile/bodyfile.txt and requires sufficient output storage.
View UAC Bodyfile Extractor on GitHub (opens in a new tab)Work with common Linux filesystems and forensic image formats while protecting source evidence.
Mounts logical volumes from raw or E01 forensic images using restrictive, read-only mount options and managed clean-up.
Requirements: Requires root privileges and the relevant LVM, filesystem and EWF utilities for the source image.
View LVM Forensic Image Mounter on GitHub (opens in a new tab)Locates and extracts the filesystem block associated with a specified inode in an ext4 image.
Requirements: Requires The Sleuth Kit fsstat and blkcat utilities.
View Ext4 Inode Extractor on GitHub (opens in a new tab)Extracts inode details, timestamps and file content from a Btrfs image without mounting it.
Requirements: Requires btrfs-progs and currently searches for files by name in the filesystem root.
View Btrfs File Extractor on GitHub (opens in a new tab)Finds E01 images beneath a directory and runs mmls against each one for rapid partition-layout review.
Requirements: Requires The Sleuth Kit mmls utility and access to the complete image segments for each E01 set.
View Bulk E01 Partition Check on GitHub (opens in a new tab)Checks the live mount table and fstab for common device-mapper paths to indicate whether LVM2 is in use.
Requirements: Uses grep with Perl-compatible expressions and provides a preliminary indication rather than a complete volume inventory.
View LVM2 Usage Check on GitHub (opens in a new tab)Decodes a 16-byte XFS extent record and calculates the starting block and byte address for the referenced data.
Requirements: Assumes a 4,096-byte filesystem block; investigators must adjust the result when examining a different block size.
View XFS Inode Extent Converter on GitHub (opens in a new tab)Create controlled, time-limited upload links for transferring common Linux evidence artefacts to Amazon S3.
Generates a time-limited Amazon S3 PUT URL for uploading an AVML memory image using a host-and-time-based object name.
Requirements: Requires Python, boto3, an authorised AWS profile and locally configured bucket, region and expiry settings.
View AVML Upload URL Creator on GitHub (opens in a new tab)Generates a time-limited Amazon S3 PUT URL for uploading a packaged dwarf2json symbol file and System.map.
Requirements: Requires Python, boto3, an authorised AWS profile and locally configured bucket, region and expiry settings.
View Volatility Symbols Upload URL Creator on GitHub (opens in a new tab)Generates a time-limited Amazon S3 PUT URL for uploading a UAC evidence archive with a host-and-time-based object name.
Requirements: Requires Python, boto3, an authorised AWS profile and locally configured bucket, region and expiry settings.
View UAC Upload URL Creator on GitHub (opens in a new tab)Review document metadata for changes and discrepancies that may warrant further investigation.
Searches documents by date and identifies potentially significant differences between creator and last-modified metadata.
Requirements: Requires ExifTool; metadata differences are investigative leads rather than proof of unauthorised activity.
View EXIF Evidence Review on GitHub (opens in a new tab)