ntdsxtract. Active Directory forensic framework
memory-baseliner. Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on multiple such images
volatility_plugins. Volatility plugins created by the author
