// TOOLBOX — BY DOMAIN
Screwdrivers, flux capacitors & other precision instruments.
The workbench, sorted by what I investigate — not just what I run. Each tool carries an honest, job-anchored level and the completed labs behind it — difficulty rated by the platform, not by me. Click any receipt to check it.
ANDROID FORENSICS
app data, artifacts, extractionsRaw queries against app databases — what the parsers read, I read too. WAL files, freelists, deleted records; the layer under every mobile artifact.
“comfortable writing joins across app DBs; carving deleted rows is next”
sqlitebrowser.org · open source →Android Logs, Events And Protobuf Parser. Turns a raw Android extraction into a readable timeline — logs, events, usage stats, app databases.
“comfortable with the parser output; still learning the underlying SQLite schemas”
github.com/abrignoni/ALEAPP · open source →Dex-to-Java decompiler with GUI. Opens an APK and turns the bytecode back into readable Java — manifest, resources, code structure, all searchable.
“handling the tool is the easy part — decompile, search, navigate; reading the code it produces is the skill still in training”
github.com/skylot/jadx · open source →WINDOWS FORENSICS
disk, registry, endpoint triageRegistry Explorer, ShellBags Explorer, MFTECmd, Timeline Explorer & friends — one author, one ecosystem, and the standard drawer of Windows artifact parsers in DFIR.
“carried a full hard-rated disk investigation with Registry Explorer, MFTECmd and Timeline Explorer — the ecosystem still runs deeper, but it feels like home now”
ericzimmerman.github.io · free →Memory forensics framework. Process trees, injected code, registry hives from RAM — the evidence that vanishes on reboot.
“my go-to for RAM — plugin selection and process/DLL analysis feel natural now; deep kernel-structure work is the next mountain”
github.com/volatilityfoundation · open source →Raw queries against app databases — what the parsers read, I read too. WAL files, freelists, deleted records; the layer under every mobile artifact.
“comfortable writing joins across app DBs; carving deleted rows is next”
sqlitebrowser.org · open source →Open-source disk forensics platform. Timeline analysis, keyword search, file carving — where imaged evidence becomes a case.
“comfortable with the full case workflow — timeline, keyword search, carving; module tuning still to explore”
autopsy.com · open source →Kroll Artifact Parser and Extractor. Targeted triage collection — grab what matters in minutes instead of imaging for hours.
“first real triage on a hard-rated lab — targets and modules make sense, the end-to-end workflow is starting to click”
kroll.com · free for individuals →Forensic disk imaging, evidence preview and export. Acquisition workhorse: image, hash, verify, then work on the copy — never the original.
“acquisition end-to-end solo — image, hash, verify; advanced export workflows still growing”
exterro.com · free →NETWORK FORENSICS
pcaps, protocols, traffic analysisPacket analysis. From DHCP handshakes to carved TCP streams — reading traffic byte-by-byte and turning it into a story.
“comfortable with display filters and protocol dissection; TLS decryption and advanced Statistics tooling still to come”
wireshark.org · open source →MEMORY FORENSICS
RAM captures, volatile evidenceMemory forensics framework. Process trees, injected code, registry hives from RAM — the evidence that vanishes on reboot.
“my go-to for RAM — plugin selection and process/DLL analysis feel natural now; deep kernel-structure work is the next mountain”
github.com/volatilityfoundation · open source →