All

121 repositories

peira
Public
A knowledge system that refuses to promote a claim you have not examined — with gates drawn from Socratic elenchus, 金剛經, Nyāya, Madhyamaka and the causal ladder…
Rust
•
Apache License 2.0
•0•0•11•1•Updated Aug 12, 2026Aug 12, 2026
forensicnomicon
Public
DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offli…
rust persistence incident-response
rust persistence incident-response forensics dfir threat-hunting digital-forensics sigma soc yara
Rust
•
Apache License 2.0
•2•4•0•0•Updated Aug 12, 2026Aug 12, 2026
sqlite-forensic
Public
Read-only SQLite forensic toolkit: carve deleted records (freelist/in-page/dropped-table/WAL/journal), read index b-trees & WITHOUT ROWID tables, WAL version hi…
rust sqlite incident-response
rust sqlite incident-response sqlcipher forensics dfir python-bindings digital-forensics btree wal
Rust
•
Apache License 2.0
•0•3•0•1•Updated Aug 11, 2026Aug 11, 2026
fleet-ci
Public
Reusable GitHub Actions workflow for the SecurityRonin Rust fleet: fmt, clippy, test, MSRV, coverage, cargo-deny, cargo-vet, secret scan, and fuzz smoke in one …
Python
•0•0•0•0•Updated Aug 11, 2026Aug 11, 2026
forensic-vfs-engine
Public
The forensic-vfs registry + resolver — one Vfs::open(path) that detects the container/volume/filesystem stack and mounts a read-only dyn FileSystem. Batteries-i…
rust filesystem incident-response
rust filesystem incident-response forensics dfir vfs disk-image digital-forensics
Rust
•
Apache License 2.0
•1•2•2•0•Updated Aug 10, 2026Aug 10, 2026
forensic-vfs-mount
Public
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
xpress-huffman
Public
Pure-Rust, panic-free decompressor for Microsoft Xpress-Huffman ([MS-XCA] §2.2.4) — the codec behind Win10+ prefetch, hiberfil.sys, SMB3 and registry-hive compr…
windows rust compression
windows rust compression prefetch forensics dfir no-std hibernation xpress smb3
Rust
•
Apache License 2.0
•0•1•0•0•Updated Aug 10, 2026Aug 10, 2026
lzo
Public
GPL-free, safe, no_std pure-Rust LZO1X decompressor — decode lzo1x_1 / lzo1x_999 streams (lzop, kernel/initramfs, btrfs, liblzo2) with zero C, zero dependencies…
rust compression decompression
rust compression decompression forensics safe no-std lzo pure-rust lzop lzo1x
Rust
•
Apache License 2.0
•2•1•0•0•Updated Aug 10, 2026Aug 10, 2026
lzvn
Public
Safe, no_std pure-Rust Apple LZVN decompressor — length-tolerant for real macOS decmpfs resource-fork blocks. Published as lzvn-core (lib name lzvn).
macos rust apple
macos rust apple compression forensics dfir no-std decmpfs lzvn
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
elephant-diffuser
Public
The BitLocker Elephant Diffuser (Diffuser A + Diffuser B + sector-key XOR) in pure Rust — the format primitive with no ecosystem crate, validated in-situ agains…
rust cryptography encryption
rust cryptography encryption forensics dfir no-std bitlocker
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
4n6mount
Public
Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4, AD1, zip/7z/tar, LiME…
windows rust fuse
windows rust fuse dokan filesystem incident-response forensics dfir disk-image ntfs
Rust
•
Apache License 2.0
•0•6•1•0•Updated Aug 10, 2026Aug 10, 2026
hfsplus-forensic
Public
Forensic-grade Apple HFS+/HFSX reader — volume header, catalog B-tree directory listing, and data-fork file extraction
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
state-history-forensic
Public
State-history forensic vocabulary — zero-dependency [H] KNOWLEDGE-tier types and traits lifting each forensic navigation primitive to a time-indexed variant. No…
rust incident-response forensics
rust incident-response forensics dfir digital-forensics temporal state-history
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
udf-forensic
Public
Forensic-grade UDF (ECMA-167/OSTA) reader — volume recognition, partition maps, File Entry/FID traversal, file data
Rust
•
Apache License 2.0
•1•1•0•1•Updated Aug 10, 2026Aug 10, 2026
forensic-hashdb
Public
File hash databases for digital forensics — NSRL/CIRCL known-good, malware known-bad, known-vulnerable Windows drivers (loldrivers), and analyst-supplied MD5/SH…
rust incident-response forensics
rust incident-response forensics dfir hashset digital-forensics nsrl loldrivers
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
disk-forensic
Public
Forensic disk-image orchestrator — decodes E01/VMDK/VHDX/VHD/QCOW2/DMG containers, auto-detects MBR/GPT/APM, and routes ISO 9660 to filesystem analysis
rust container dmg
rust container dmg apm forensics dfir disk-image partition ntfs mbr
Rust
•
Apache License 2.0
•0•3•0•0•Updated Aug 10, 2026Aug 10, 2026
useract-forensic
Public
User-activity forensics — unify shell history, peripheral connections (and v0.2: LNK/shellbags/SRUM/UserAssist/MRU) into one per-user timeline with cross-source…
rust correlation timeline
rust correlation timeline incident-response forensics dfir digital-forensics user-activity
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
blob-decoder
Public
Scored identify + decode of unknown forensic BLOBs (bplist/base64/hex/uuid/gzip/zlib/snappy), with recursive unwrap
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
cfb-forensic
Public
OLE/CFB ([MS-CFB]) forensic analyzer — carves compound files for orphaned (deleted) directory entries, free-sector + slack residue, and structural tamper tells.…
rust incident-response forensics
rust incident-response forensics dfir digital-forensics ole compound-file cfb carving jumplist
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
usb-forensic
Public
USB device-history correlation engine — reconstructs USB connection history from every Windows artifact (registry, SetupAPI, event logs, LNK) plus macOS/Linux, …
windows macos linux
windows macos linux rust registry correlation usb timeline reproducible incident-response
Rust
•
Apache License 2.0
•0•0•10•0•Updated Aug 10, 2026Aug 10, 2026
shellitem
Public
Windows Shell Item / ITEMIDLIST (PIDL) parser — decode .lnk LinkTargetIDList and registry ShellBags into typed items + a reconstructed path. A reusable forensic…
windows rust incident-response
windows rust incident-response forensics dfir shell-item pidl itemidlist
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
safe-decode
Public
Panic-free, allocating byte-to-value transforms with no format knowledge: ROT13, the UTF-16 decoder family with its NUL policy named in each function, and hex r…
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
jsonguard
Public
Secure output sanitization and input inspection for JSON/JSONL, CSV, and TSV — guards against formula injection, bidi-override, control-character, and encoding …
rust sanitization security
rust sanitization security tsv json csv injection bidi utf8 no-std
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
safe-read
Public
Panic-free bounded integer readers over untrusted byte slices (no_std, no deps)
rust security parsing
rust security parsing forensics no-std byte-parsing panic-free untrusted-input
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
forensic-carve
Public
Fleet carving contract + single-pass sweep engine: signature detection over unallocated/memory regions dispatched to per-format carvers.
rust incident-response forensics
rust incident-response forensics dfir digital-forensics data-recovery carving
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
timeglyph
Public
Decode, identify & encode forensic timestamps — every reading ranked, scored, and cited — plus a timezone/DST/leap-aware reference calendar for interpreting the…
timeline datetime calendar
timeline datetime calendar timezone holidays timestamp filetime leap-seconds
Rust
•
Apache License 2.0
•0•5•0•0•Updated Aug 10, 2026Aug 10, 2026
shrinkpath
Public
Smart cross-platform path shortening for Rust — target-length guarantee, identity preservation, zero dependencies
path shorten
path shorten
Rust
•
Apache License 2.0
•0•2•0•0•Updated Aug 10, 2026Aug 10, 2026
journald-forensic
Public
From-scratch systemd journal (.journal) forensic reader — parse entries without journalctl/systemd, carve from unallocated space, and flag tampering (sequence g…
linux rust security
linux rust security log-analysis systemd incident-response forensics dfir journald anti-forensics
Rust
•
Apache License 2.0
•0•0•0•0•Updated Aug 10, 2026Aug 10, 2026
prop-window
Public
A film prop browser — real Chromium (Electron) whose address bar shows any URL you set, decoupled from the page it loads.
electron browser devtools
electron browser devtools chromium film prop
JavaScript
•
Apache License 2.0
•0•0•1•0•Updated Aug 10, 2026Aug 10, 2026
blazehash
Public
Forensic file hasher — BLAKE3 at 1,640 MB/s, 25 hash algorithms, Ed25519 + post-quantum signing, Bitcoin timestamps, YARA scanning, 50+ remote backends. hashdee…
hashing rust incident-response
hashing rust incident-response s3 hash forensics dfir sha256 threat-hunting stix
Rust
•
Apache License 2.0
•1•8•0•0•Updated Aug 9, 2026Aug 9, 2026

ProTip! When viewing an organization's repositories, you can use the props. filter to filter by custom property.

Navigation Menu

Security Ronin

All

All

121 repositories

peira

forensicnomicon

sqlite-forensic

fleet-ci

forensic-vfs-engine

forensic-vfs-mount

xpress-huffman

lzo

lzvn

elephant-diffuser

4n6mount

hfsplus-forensic

state-history-forensic

udf-forensic

forensic-hashdb

disk-forensic

useract-forensic

blob-decoder

cfb-forensic

usb-forensic

shellitem

safe-decode

jsonguard

safe-read

forensic-carve

timeglyph

shrinkpath

journald-forensic

prop-window

blazehash

All

All

Repositories list

121 repositories