Skip to content
@SecurityRonin

Security Ronin

Popular repositories Loading

  1. docx-mcp docx-mcp Public

    MCP server for reading and editing Word (.docx) documents with track changes, comments, footnotes, and structural validation

    Python 55 17

  2. chat4n6 chat4n6 Public

    Forensic extraction for WhatsApp, Signal, and Telegram — 8-layer SQLite recovery, anti-forensics detection, court-ready reports.

    Rust 45 6

  3. usnjrnl-forensic usnjrnl-forensic Public archive

    The most comprehensive NTFS USN Journal parser: full path reconstruction (CyberCX Rewind), TriForce correlation (MFT + LogFile + UsnJrnl), ghost record recovery, anti-forensics detection, timestomp…

    Rust 31

  4. alaya alaya Public

    A memory engine for conversational AI agents, inspired by neuroscience and Buddhist psychology

    Rust 17 3

  5. memory-forensic memory-forensic Public

    Walk any memory dump. Find what's hidden. Linux + Windows kernel forensics from a single static Rust binary — no Python required.

    Rust 12 1

  6. issen issen Public

    Point it at disk + memory evidence; get a correlated, ATT&CK-mapped attack timeline. Rust DFIR orchestrator: one command ingests E01/EWF/VMDK/raw + memory dumps, parses NTFS/registry/EVTX/prefetch/…

    Rust 11 2

Repositories

Showing 10 of 123 repositories
  • forensicnomicon Public

    DFIR artifact catalog (6,554 artifacts, LOL/LOFL binaries, abusable sites) plus the normalized report vocabulary the SecurityRonin analyzer fleet shares — offline Rust library + 4n6query CLI

    SecurityRonin/forensicnomicon's past year of commit activity
    Rust 6 Apache-2.0 2 0 1 Updated Sep 25, 2026
  • timeglyph Public

    Decode, identify & encode forensic timestamps — every reading ranked, scored, and cited — plus a timezone/DST/leap-aware reference calendar for interpreting them (DST folds, leap seconds, GPS week, format epochs, moon phase). Rust CLI + library, WASM playground, and a live hover-to-decode overlay.

    SecurityRonin/timeglyph's past year of commit activity
    Rust 6 Apache-2.0 0 0 1 Updated Sep 25, 2026
  • ios-backup-forensic Public

    Native, read-only, panic-free reader and anomaly auditor for iOS device backups (Finder / iTunes / MobileSync), including encrypted backups.

    SecurityRonin/ios-backup-forensic's past year of commit activity
    Rust 0 0 0 1 Updated Sep 24, 2026
  • ronin-issen Public

    The SecurityRonin forensic fleet — 86 pure-Rust DFIR libraries fronted by Issen: point it at a disk image + memory dump, get one correlated ATT&CK-mapped timeline. Governance, ADRs, and the component map.

    SecurityRonin/ronin-issen's past year of commit activity
    Python 6 Apache-2.0 0 2 0 Updated Sep 21, 2026
  • btrfs-forensic Public

    Btrfs forensic library — parse superblock/chunk-tree/fs-tree/extents, detect integrity anomalies, carve deleted files via CoW backup roots. Pure-Rust, panic-free, fuzzed, Tier-1-validated.

    SecurityRonin/btrfs-forensic's past year of commit activity
    Rust 0 Apache-2.0 0 0 0 Updated Sep 21, 2026
  • ntfs-forensic Public

    From-scratch NTFS reader (ntfs-core: MFT, attributes, indexes, data runs, LZNT1, $UsnJrnl:$J change journal over Read+Seek) plus a graded anomaly auditor (ntfs-forensic: timestomping, alternate data streams, deleted records, MFT/LogFile tamper checks) — panic-free, fuzzed, no unsafe

    SecurityRonin/ntfs-forensic's past year of commit activity
    Rust 1 Apache-2.0 2 4 2 Updated Sep 21, 2026
  • shellitem Public

    Windows Shell Item / ITEMIDLIST (PIDL) parser — decode .lnk LinkTargetIDList and registry ShellBags into typed items + a reconstructed path. A reusable forensic primitive. Pure Rust.

    SecurityRonin/shellitem's past year of commit activity
    Rust 0 Apache-2.0 0 0 1 Updated Sep 20, 2026
  • 4n6mount Public

    Mount forensic disk images, archives & memory dumps as a filesystem on Linux/macOS/Windows — ext4/NTFS/exFAT/HFS+/APFS/ISO, EWF/VMDK/AFF4, AD1, zip/7z/tar, LiME/AVML/crash dumps. FUSE + Dokan, ro/rw COW overlay, deleted-file browsing, NSRL filtering. Pure Rust, Apache-2.0.

    SecurityRonin/4n6mount's past year of commit activity
    Rust 10 Apache-2.0 0 1 0 Updated Sep 20, 2026
  • journald-forensic Public

    From-scratch systemd journal (.journal) forensic reader — parse entries without journalctl/systemd, carve from unallocated space, and flag tampering (sequence gaps, timestamp regressions, truncation, online-state)

    SecurityRonin/journald-forensic's past year of commit activity
    Rust 0 Apache-2.0 0 0 0 Updated Sep 20, 2026
  • discord-desktop-forensic Public

    Discord desktop forensic parser — recover account/token/cached channels+messages from Chromium LevelDB. Token redacted by default. Panic-free by lint.

    SecurityRonin/discord-desktop-forensic's past year of commit activity
    Rust 0 Apache-2.0 0 0 0 Updated Sep 20, 2026
View all repositories

People

This organization has no public members. You must be a member to see who’s a part of this organization.

Top languages

Loading…

Most used topics

Loading…