diff --git a/README.md b/README.md index 5a4e94d..c9b8107 100644 --- a/README.md +++ b/README.md @@ -17,4 +17,9 @@ A curated list of tools for incident response * [AccessData FTK Imager](http://accessdata.com/support/adownloads#FTKImager) - AccessData FTK Imager is a forensics tool whose main purpose is to preview recoverable data from a disk of any kind. FTK Imager can also acquire live memory and paging file on 32bit and 64bit systems ### Memory Analysis Tools +* [Volatility](https://github.com/volatilityfoundation/volatility) - An advanced memory forensics framework +* [Evolve](https://github.com/JamesHabben/evolve) +* [WindowsSCOPE](http://www.windowsscope.com/index.php?page=shop.product_details&flypage=flypage.tpl&product_id=35&category_id=3&option=com_virtuemart) - another memory forensics and reverse engineering tool used for analyzing volatile memory. It is basically used for reverse engineering of malwares. It provides the capability of analyzing the Windows kernel, drivers, DLLs, virtual and physical memory +* [Responder PRO](http://www.countertack.com/responder-pro) - Responder PRO is the industry standard physical memory and automated malware analysis solution +* [KnTList](http://www.gmgsystemsinc.com/knttools/) - Computer memory analysis tools