Maxim Suhanov

regf. Windows registry file format specification

dfir_ntfs. An NTFS/FAT parser for digital forensics & incident response

Linux-write-blocker. The kernel patch and userspace tools to enable Linux software write blocking

yarp. Yet another registry parser

winmem_decompress. Extract compressed memory pages from page-aligned data

ntfs-samples. NTFS samples

regf-samples. Windows registry samples

registry-miner. Registry Miner

grub-unlzma. Locate and extract a compressed core image within a bootable image of GRUB

articles. Various files linked to my articles, posts, etc.

grub-raiddump. The GRUB command to acquire the contents of a fake RAID

easy_triage. Scripts to triage compromised systems (Linux, ESXi, FreeBSD/NetScaler)

winbootpath. Boot path verification for Windows on read-only media

openssh-portable. Portable OpenSSH