Fox

About

Fox is designed as the Forensic Examiners Swiss Army Knife, providing many useful features to leverage and streamline the digital forensic examination process. This cross-platform command-line interface (CLI) tool specializes in the read-only processing of file-based forensic artifacts, delivering uninterpreted output to support in-depth analysis across various operating systems.

Key Features

• Performs string carving and automatic classification with over 290 classes in Hashcat notation.
• Dumps critical forensic artifacts including Active Directory, EDB, Windows shortcut, prefetch, Linux ELF, and Windows PE/COFF executables.
• Integrates utility functions akin to `grep`, `head`, `tail`, `uniq`, `wc`, and `hexdump` with syntax highlighting.
• Offers a dedicated "Hunt" mode for carving Linux Journals and Windows Event Logs, generating super timelines in Common Event Format (CEF), and filtering events using Sigma Rules.
• Supports verification of IPs, URLs, Domains, and files via the VirusTotal API.
• 2 GitHub stars

Use Cases

• Analyzing Windows Event Logs and Linux Journals for suspicious activity and creating super timelines for incident response.
• Extracting and dumping critical forensic artifacts such as Active Directory, EDB, shortcut, prefetch, and executable files for evidence collection.
• Performing comprehensive file analysis including string carving, entropy calculation, and hashing across a wide array of file and disk formats.