Libs

List of libraries that can be used in forensic software. This is mostly just an extension of the overview of github.com/libyal/libyal, which is an insane collection of parsers. View a little wider: http://cugu.github.io/awesome-forensics/LIBS

URL Description (Language) Last Commit Stars License
Forensic Artifact Handling
artifactlib Process forensic artifact definition files (Go & Python) Last Commit GitHub stars License
artifacts Process forensic artifact definition files (Python) Last Commit GitHub stars License
High Level File System Parser
fslib Parse filesystems, archives and other data types (Go) Last Commit GitHub stars License
dfvfs Digital Forensics Virtual File System (Python) Last Commit GitHub stars License
pytsk Bindings for The Sleuth Kit (libtsk) (Python) Last Commit GitHub stars License
Store
forensicstore A forensics storage format (Go & Python) last-commit GitHub stars License
acstore Attribute Container store (Python) last-commit GitHub stars License
Cross-platform Functionality
libcdata generic data functions (C) Last Commit GitHub stars License
libcdatetime date and time functions (C) Last Commit GitHub stars License
libcdirectory directory functions (C) Last Commit GitHub stars License
libcerror error functions (C) Last Commit GitHub stars License
libcfile file functions (C) Last Commit GitHub stars License
libclocale locale functions (C) Last Commit GitHub stars License
libcnotify notification functions (C) Last Commit GitHub stars License
libcpath path functions (C) Last Commit GitHub stars License
libcsplit split string functions (C) Last Commit GitHub stars License
libcthreads threads functions (C) Last Commit GitHub stars License
dfdatetime Digital Forensics date and time (Python) Last Commit GitHub stars License
Data Formats
libcaes AES encryption functions (C) Last Commit GitHub stars License
libfcache generic file data cache functions (C) Last Commit GitHub stars License
libfcrypto encryption formats (C) Last Commit GitHub stars License
libfdata generic file data functions (C) Last Commit GitHub stars License
libfdatetime for date and time formats (C) Last Commit GitHub stars License
libfguid for GUID/UUID format (C) Last Commit GitHub stars License
libfmapi for Message API (MAPI) data types (C) Last Commit GitHub stars License
libfole for Object Linking and Embedding (OLE) data types (C) Last Commit GitHub stars License
libfplist for plist formats (C) Last Commit GitHub stars License
libftxf for Transactional NTFS (TxF) data types (C) Last Commit GitHub stars License
libftxr for Transactional Registry (TxR) data types (C) Last Commit GitHub stars License
libfusn for Update Sequence Number (USN) Journal data types (C) Last Commit GitHub stars License
libfvalue generic file value functions (C) Last Commit GitHub stars License
libfwevt for Windows XML Event Log (EVTX) data types (C) Last Commit GitHub stars License
libfwnt for Windows NT data types (C) Last Commit GitHub stars License
libfwps for Windows Property Store data types (C) Last Commit GitHub stars License
libfwsi for Windows Shell Item data types (C) Last Commit GitHub stars License
libhmac Hash-based Message Authentication Codes (HMAC) (C) Last Commit GitHub stars License
libuna Unicode and ASCII (byte string) conversions (C) Last Commit GitHub stars License
File Formats
libagdb Windows SuperFetch database format (C) Last Commit GitHub stars License
libcreg Windows 9x/Me Registry File (CREG) format (C) Last Commit GitHub stars License
libesedb Extensible Storage Engine (ESE) Database File (EDB) format (C) Last Commit GitHub stars License
libevt Windows Event Log (EVT) format (C) Last Commit GitHub stars License
libevtx Windows XML Event Log (EVTX) format (C) Last Commit GitHub stars License
libexe PE/COFF Executable (EXE) format (C) Last Commit GitHub stars License
libgzipf GZIP file format (C) Last Commit GitHub stars License
liblnk Windows Shortcut File (LNK) format (C) Last Commit GitHub stars License
libmdmp Windows Minidump (MDMP) format (C) Last Commit GitHub stars License
libmsiecf Microsoft Internet Explorer (MSIE) Cache File (index.dat) format (C) Last Commit GitHub stars License
libnk2 Microsoft Outlook Nickfile (NK2) format (C) Last Commit GitHub stars License
libnsfdb Notes Storage Facility (NSF) database file format (C) Last Commit GitHub stars License
libolecf OLE 2 Compound File (OLECF) format (C) Last Commit GitHub stars License
libpff Personal Folder File (PFF) format (C) Last Commit GitHub stars License
libregf Windows NT Registry File (REGF) format (C) Last Commit GitHub stars License
libscca Windows Prefetch File (SCCA) format (C) Last Commit GitHub stars License
libwtcdb Windows (Vista/7) Explorer thumbnail cache database format (thumbcache.db) (C) Last Commit GitHub stars License
dfwinreg Digital Forensics Windows Registry (dfWinReg) (Python) Last Commit GitHub stars License
evtx Parser for Microsoft Event Logs (Go) Last Commit GitHub stars License
go-prefetch A implementation of a prefetch parser. (Go) Last Commit GitHub stars License
python-evt Parser for classic Windows Event Log files (.evt) (Python) Last Commit GitHub stars License
python-evtx Parser for recent Windows Event Log files (.evtx) (Python) Last Commit GitHub stars License
python-registry Parser for Windows Registry hives. (Python) Last Commit GitHub stars License
python-sdb Parser for Application Compatibility Shim Databases (.sdb files) (Python) Last Commit GitHub stars License
In-file Formats
libmapidb Exchange MAPI database format (C) Last Commit GitHub stars License
libwrc Windows Resource Compiler (WRC) format (C) Last Commit GitHub stars License
File System Formats
libfsapfs Apple File System (APFS) format (C) Last Commit GitHub stars License
libfsclfs Common Log File System (CLFS) format (C) Last Commit GitHub stars License
libfsext Extended File System (EXT) format (C) Last Commit GitHub stars License
libfshfs Hierarchical File System (HFS) format (C) Last Commit GitHub stars License
libfsntfs New Technology File System (NTFS) format (C) Last Commit GitHub stars License
libfsrefs Resilient File System (ReFS) format (C) Last Commit GitHub stars License
go-ntfs An NTFS file parser (Go) Last Commit GitHub stars License
python-ntfs Library for NTFS analysis (Python) Last Commit GitHub stars License
Volume (System) Formats
libbde BitLocker drive encryption (BDE) (C) Last Commit GitHub stars License
libfvde FileVault drive encryption (FVDE) (C) Last Commit GitHub stars License
libluksde LUKS Disk Encryption (C) Last Commit GitHub stars License
libvsgpt GUID Partition Table (GPT) volume system format (C) Last Commit GitHub stars License
libvshadow Volume Shadow Snapshot (VSS) format (C) Last Commit GitHub stars License
libvslvm Linux Logical Volume Manager (LVM) volume system format (C) Last Commit GitHub stars License
libvsmbr Master Boot Record (MBR) volume system format (C) Last Commit GitHub stars License
Storage Media Image Formats
pyaff4 A implementation of the AFF4 standard. (Python) Last Commit GitHub stars License
libewf Expert Witness Compression Format (EWF) image format (C) Last Commit GitHub stars License
libhibr Windows Hibernation File (hiberfil.sys) format (C) Last Commit GitHub stars License
libmodi Mac OS disk image formats (C) Last Commit GitHub stars License
libodraw optical disc (split) RAW image format (bin/cue, iso/cue) (C) Last Commit GitHub stars License
libphdi Parallels Hard Disk image format (C) Last Commit GitHub stars License
libqcow QEMU Copy-On-Write (QCOW) image format (C) Last Commit GitHub stars License
libsmdev storage media devices (C) Last Commit GitHub stars License
libsmraw (split) RAW image format (C) Last Commit GitHub stars License
libvhdi Virtual Hard Disk (VHD) image format (C) Last Commit GitHub stars License
libvmdk VMware Virtual Disk (VMDK) format (C) Last Commit GitHub stars License
aff4 Advanced Forensic File Format 4 (Python (& C)) Last Commit GitHub stars License
c-aff4 An AFF4 C++ implementation. (C++) Last Commit GitHub stars License
Utility Libraries
libbfio basic file input/output abstraction (C) Last Commit GitHub stars License
libsigscan binary signature scanning (C) Last Commit GitHub stars License
libtableau read metadata from Tableau(TM) forensic bridges (write blockers) (C) Last Commit GitHub stars License