Description

Provide forensics tools unavailable in nixpkgs.

List

• analyzeMFT: MFT Parser
• bmc-tools: RDP Bitmap Cache parser
• docker-explorer: Offline docker acquisitions
• hindsight: Web browser forensics for Google Chrome/Chromium
• Mac-Locations-Scraper: macOS/iOS location data extractor
• PsqlHunter: Hunt sql commands in pcap
• recuperabit: A tool for forensic file system reconstruction
• regrippy: A modern Python-3-based alternative to RegRipper
• timeliner: A rewrite of mactime, a bodyfile reader
• usnparser: A command utility to read and monitor the NTFS/ReFS USN change Journal
• xLEAPP: xLEAPP - Merging of iLEAPP/RLEAPP/vLEAPP, ALEAPP, cLEAPP
• yarGen: yarGen is a generator for YARA rules

Build

git clone https://github.com/MikeHorn-git/nixpkgs-forensics.git
cd nixpkgs-forensics

Single

nix-build -A packages.$(Package)

Example

nix-build -A packages.yarGen

All

nix-build -A defaultPackage

To-Do

• Open PRs in nixpkgs. Like #331325