awesome-incident-response

A curated list of tools for incident response

• Disk Image Creation Tools
• Memory Analysis Tools
• Memory Imaging Tools
• Process Dump Tools

IR tools Collection

Disk Image Creation Tools

Web traffic anonymizers for analysts.

• GetData Forensic Imager - GetData Forensic Imager is a Windows based program that will acquire, convert, or verify a forensic image in one of the following common forensic file formats
• Guymager - Guymager is a free forensic imager for media acquisition on Linux
• AccessData FTK Imager - AccessData FTK Imager is a forensics tool whose main purpose is to preview recoverable data from a disk of any kind. FTK Imager can also acquire live memory and paging file on 32bit and 64bit systems

Memory Analysis Tools

• Volatility - An advanced memory forensics framework
• Evolve
• WindowsSCOPE - another memory forensics and reverse engineering tool used for analyzing volatile memory. It is basically used for reverse engineering of malwares. It provides the capability of analyzing the Windows kernel, drivers, DLLs, virtual and physical memory
• Responder PRO - Responder PRO is the industry standard physical memory and automated malware analysis solution
• KnTList - Computer memory analysis tools

Memory Imaging Tools

• OSForensics - OSForensics can acquire live memory on 32bit and 64bit systems. A dump of an individual process’s memory space or physical memory dump can be done
• Belkasoft Live RAM Capturer - A tiny free forensic tool to reliably extract the entire content of the computer’s volatile memory – even if protected by an active anti-debugging or anti-dumping system

Process Dump Tools

• PMDump - PMDump is a tool that lets you dump the memory contents of a process to a file without stopping the process
• Microsoft User Mode Process Dumper - The User Mode Process Dumper (userdump) dumps any running Win32 processes memory image on the fly