Matthew Seyer

datatui. A Terminal UI for Data

PancakeViewer. A DFVFS Backed Forensic Viewer

PyWindowsThingies. Windows Thingies in Python for live use.

RsWindowsThingies. Windows Thingies... but in Rust

RustyUsn. USN to JSON

sansaisummit24. Tool and Jupyter Notebook used in "Enhance Investigations Using LLM, Embeddings, and Clustering" SANS AI Cybersecurity Summit talk.

RustyLnk. LNK to JSON

RustyReg. Registry to JSON. This Project is for learning purposes and is not maintained.

RustyPrefetch. Prefetch to JSON. This Project is for learning purposes and is not maintained.

libtsk-rs. Wrapper for TSK (Sleuth Kit) Bindings

RustyMft. MFT to JSON

VanillaWindowsTools. Tools for parsing and playing with https://github.com/AndrewRathbun/VanillaWindowsReference data

pyshellitems. Python library and tools for handling shell items / property lists and stores / and extension blocks. This project is for learning purposes and is not maintained.

ActivitiesCacheParser. Parse Windows ActivitiesCache to JSONL. This project is for learning purposes and is not maintained.

r-winreg. Windows Registry Parsing Library

snapio-evtx-extractor. Tool that uses aws-snap-io and libtsk to extract EVTX files from an AWS snapshot.

MonitorUserAssist. Tool that can monitor the UserAssist registry keys and decode UserAssist structs in real-time. This project is for learning purposes and is not maintained.

aws-snap-io. Library for implementing Read Seek ontop of an AWS Snapshot

JsonlTools. Tools for filtering and manipulating JSONL

LogicalRegTool. A registry tool that can be ran on a logical volume. JSONL output for NoSQL. This project is for learning purposes and is not maintained.

WinObjectIdParser. ObjectID Parsers and Tools. This project is for learning purposes and is not maintained.

sans509-helpers. Just a quick script to parse load balancer logs into json

PyRustyUsn. Python bindings for RustyUsn

sansaisummit26. SANS AI Cybersecurity Summit Workshop Labs for Powerful AI/ML Techniques for Surfacing Attacker Activity

LogicalJmpLnkTool. A jumplist and link tool that can be ran on a logical volume. JSONL output for NoSQL. This project is for learning purposes and is not maintained.

upcaseinfo-rs. $UpCase:$Info parsing tool/lib in Rust

LogicalAvacado. A DFIR Tool for processing logical volumes and inserting records into ArangoDB. This project is for learning purposes and is not maintained.

upcaseinfo-py. $UpCase:$Info parsing tool/lib in Python

r-winstructs. Windows Structures in Rust. This Project is for learning purposes and is not maintained.

r-shellitems. Shell Item Structures in Rust

SetupApiLogParser. Parse Setup API Logs to JSONL

r-pyfio. A way to pass a file-like IO object in python to Rust

forensicmatt.github.io.

evtx. A Fast (and safe) parser for the Windows XML Event Log (EVTX) format