vshadow vs forensic-catalog vs blazehash

Pure Rust parser for Windows Volume Shadow Copy (VSS) snapshots. Read-only access to VSS stores from forensic disk images without Windows APIs.

Static indicator tables for forensic analysis: suspicious ports, LOLBins, persistence paths, execution artifacts, anti-forensics indicators, and more

Forensic file hasher — hashdeep for the modern era, BLAKE3 by default