Anti-Forensic tool for data hiding on FAT32 Filesystem. It exploits Directory Entry.
-
Updated
May 30, 2022
#
filesystem-forensics
Here are 3 public repositories matching this topic...
NTFS $MFT triage for incident responders: dump, search and export from images, live volumes or a collected $MFT. Pure Python, no dependencies.
forensics dfir digital-forensics forensic-analysis data-recovery file-recovery mft digital-forensics-incident-response windows-forensics forensics-tools dfir-tools filesystem-forensics deleted-files deleted-files-recovery file-recovery-tool data-recovery-tool digital-forensics-tool master-file-table incident-response-tool digital-forensics-and-incident-response
-
Updated
Oct 1, 2026 - Python
Apple File System (APFS) forensic library — from-scratch pure-Rust reader (apfs-core) + anomaly analyzer (apfs-forensic) for container, volume, snapshot, encryption and sealed-volume structures. Panic-free, no runtime deps. Design + scaffold; implementation in progress.
macos rust incident-response forensics dfir file-system digital-forensics apfs filesystem-forensics apple-file-system
-
Updated
Sep 20, 2026 - Rust
Add this topic to your repo
To associate your repository with the filesystem-forensics topic, visit your repo's landing page and select "manage topics."