Pinned Loading Application for viewing/searching large text/log files (WPF port of the original LogViewer) C# 60 11 Emulates the Sysinternals Autoruns tool, but for DFIR purposes e.g. multi user processing C# 55 5 volatility-runner is a command line application designed to speed up memory forensics using the volatility framework, primarily for instances where the user has multiple memory dumps to analyse. Go 10 3 SessionViewer is a PCAP TCP session reconstructor with a UI to view the data flows, and export data C# 12 5 Looks stuff up (MD5, SHA256, IP, Domains, URL's, strings e.g. mutexes)... Go 35 8 Parses the WMI object database....looking for persistence C# 35 8