From 92f687ae4cf1ea793b23a3b41de84746f5e33127 Mon Sep 17 00:00:00 2001 From: Andreas Hunkeler Date: Mon, 6 Apr 2020 11:42:12 +0200 Subject: [PATCH] Add CyLR to evidence collection --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 03b386c..bf7fee8 100644 --- a/README.md +++ b/README.md @@ -90,6 +90,7 @@ Digital Forensics and Incident Response (DFIR) teams are groups of people in an * [bulk_extractor](https://github.com/simsong/bulk_extractor) - Computer forensics tool that scans a disk image, a file, or a directory of files and extracts useful information without parsing the file system or file system structures. Because of ignoring the file system structure, the program distinguishes itself in terms of speed and thoroughness. * [Cold Disk Quick Response](https://github.com/rough007/CDQR) - Streamlined list of parsers to quickly analyze a forensic image file (`dd`, E01, `.vmdk`, etc) and output nine reports. +* [CyLR](https://github.com/orlikoski/CyLR) - The CyLR tool collects forensic artifacts from hosts with NTFS file systems quickly, securely and minimizes impact to the host. * [ir-rescue](https://github.com/diogo-fernan/ir-rescue) - Windows Batch script and a Unix Bash script to comprehensively collect host forensic data during incident response. * [Live Response Collection](https://www.brimorlabs.com/tools/) - Automated tool that collects volatile data from Windows, OSX, and *nix based operating systems. * [Margarita Shotgun](https://github.com/ThreatResponse/margaritashotgun) - Command line utility (that works with or without Amazon EC2 instances) to parallelize remote memory acquisition.