dfirscripts/siftgrab repository overview

Siftgrab is an automation script that simplifies the process of parsing Windows forensic artifacts from Linux. It is a wrapper for various open-source forensic tools and facilitates the mounting and extraction of forensic data from Windows systems.

Siftgrab runs on Ubuntu 22.04 and can be installed as a Docker Image.

It provides easy access to different open source Linux forensic tools and custom scripts. It runs without having to separately locate download, install, or remember different command line options.

It can also be used at scale to process multiple data collections at once from tools like Kape and CyLR.