A single Docker container with a complete DFIR toolkit pre-installed and 100% offline. Every Sigma/YARA rule set, capa rule, registry plugin, and Volatility memory-symbol pack is baked into the image — no tool ever reaches the internet to work on your evidence. Build once, run it air-gapped forever.
Why this exists: spinning up forensic tooling normally means installing a dozen tools, chasing dependencies, and downloading rule/symbol packs at the worst time. This is all of it, pre-wired, in one
docker run.
- Offline guarantee
- Prerequisites
- Quick start
- How evidence flows (the
/datamount) - First 10 minutes of an incident
- Cheat sheet: which tool for which artifact
- Tool reference (in depth)
- Investigation workflows
⚠️ Handling malware safely- Troubleshooting
- Artifact glossary · Collecting evidence (KAPE/E01) · Extending the image · Versions
- What's bundled (inventory & sizes)
| Bundled data | Size | Means you can… |
|---|---|---|
| Volatility 3 symbols (Windows/Mac/Linux) | ~900 MB | analyze any standard memory dump, no symbol download |
| Sigma rules (Chainsaw) | 4,200+ | hunt event logs offline |
| Hayabusa rules | 4,900+ | timeline + detect offline |
| YARA — Yara-Rules + Neo23x0 signature-base | 1,000s | malware scanning offline |
| capa rules (Mandiant) | full set | binary capability ID offline |
| RegRipper plugins | full set | registry analysis offline |
Pull the network cable after docker load — everything still works.
- Docker (Engine or Desktop). On Ubuntu:
sudo apt install docker.io(or Docker's official repo). Verify:docker --version. - ~5 GB free disk for the loaded image.
- Your evidence files (triage collection, hives,
$MFT, memory dump, disk image, suspect files).
No GPU needed. Runs on Linux, macOS, or Windows (WSL2) hosts.
Option A — public release (no login, works on locked-down networks):
# Download dfir-aio-v4.tar.gz + SHA256SUMS.txt from the latest release:
# https://github.com/zepedara/dfir-drop/releases/latest
sha256sum -c SHA256SUMS.txt # optional integrity check
docker load -i dfir-aio-v4.tar.gz # imports the image (docker reads the gzip directly)
docker images | grep dfir-aio # verify it loadedOption B — one-line pull (if the GHCR package is public):
docker pull ghcr.io/zepedara/dfir-aio:latestRun it (from the folder that holds your evidence):
docker run -it --rm -v "$PWD":/data dfir-aioInside the container type dfir for the menu. Done.
Flags explained: -it interactive shell · --rm auto-clean the container on exit (your evidence/output on the host is untouched) · -v "$PWD":/data mounts the current host folder as /data inside.
Run a single tool without entering the shell (handy for scripting/automation) — append the command after the image name:
docker run --rm -v "$PWD":/data dfir-aio:v4 PECmd -d /data --csv /data
docker run --rm -v "$PWD":/data dfir-aio:v4 vol -f /data/mem.raw windows.pslistFully air-gapped run — prove no network is used: add --network none:
docker run --rm --network none -v "$PWD":/data dfir-aio:v4 capa-offline /data/sample.exe/data is a shared folder between your machine and the container:
host: ~/case123/ <--> container: /data
Amcache.hve /data/Amcache.hve
$MFT /data/$MFT
mem.raw /data/mem.raw
(tool output CSVs land here too, readable on your host)
- Put evidence in a host folder. 2.
cdinto it. 3.docker run … -v "$PWD":/data dfir-aio. 4. Run tools with input/output under/data. 5. Open the resulting CSVs on your host (e.g., in Eric Zimmerman's Timeline Explorer or Excel).
Windows host (PowerShell): use
-v ${PWD}:/data. cmd.exe:-v %cd%:/data.
You have a KAPE/triage collection. Get the story fast:
# 1) What malicious things fired in the event logs?
chainsaw hunt /data -s /opt/chainsaw/sigma --mapping /opt/chainsaw/repo/mappings/sigma-event-logs-all.yml --csv --output /data/_chainsaw
# 2) One chronological timeline of notable events:
hayabusa csv-timeline -d /data -o /data/_hayabusa.csv
# 3) What executed on the box?
PECmd -d /data --csv /data --csvf _prefetch.csv
AmcacheParser -f /data/Amcache.hve --csv /data --csvf _amcache.csv -i
# 4) Persistence?
regripper -r /data/SOFTWARE -p runkeysRead _chainsaw + _hayabusa.csv first — they point you at the timeframe and accounts to dig into.
| You have… | Use |
|---|---|
.evtx event logs |
chainsaw, hayabusa, EvtxECmd |
Amcache.hve |
AmcacheParser |
SYSTEM hive (ShimCache) |
AppCompatCacheParser |
Prefetch .pf |
PECmd |
$MFT, $J (USN) |
MFTECmd |
| Registry hives | regripper, RECmd, regipy |
NTUSER.DAT shellbags |
SBECmd |
$I recycle bin |
RBCmd |
.lnk / jump lists |
LECmd / JLECmd |
SRUDB.dat |
SrumECmd |
Memory dump (.raw/.mem/.dmp) |
vol (Volatility 3) |
Disk image (.dd/.E01) |
Sleuth Kit (mmls/fls/icat/tsk_recover) |
| Suspect EXE/DLL | capa-offline, floss, yara |
| Office doc / PDF / EML | oledump / pdfid,pdf-parser / emldump |
| Any file's metadata | exiftool |
Each tool: the forensic question it answers → command → how to read the output → gotchas.
Searches .evtx with 4,200+ Sigma rules.
chainsaw hunt /data -s /opt/chainsaw/sigma --mapping /opt/chainsaw/repo/mappings/sigma-event-logs-all.yml --csv --output /data/_chainsaw
chainsaw search "mimikatz" -i /data # keyword across all logsReading it: each hit = rule name + matched event + timestamp. Sort by time, pivot on the account/host. Gotcha: needs the original .evtx, not exported text logs.
hayabusa csv-timeline -d /data -o /data/_hayabusa.csv
hayabusa metrics -d /data # event-id frequencyReading it: columns include Timestamp, Level (crit/high…), RuleTitle, Details. Filter to high/crit first. Gotcha: large log sets take a minute — that's normal.
EvtxECmd -d /data --csv /data --csvf _events.csv
EvtxECmd -f /data/Security.evtx --json /dataGotcha: uses event "maps" to label fields; unmapped events still parse, just less pretty.
PECmd -d /data --csv /data --csvf _prefetch.csvReading it: LastRun + RunCount + loaded files. Gotcha: Prefetch is on Windows client OS, often disabled on servers/SSDs.
AmcacheParser -f /data/Amcache.hve --csv /data --csvf _amcache.csv -iReading it: SHA1 lets you hunt the same binary elsewhere / check threat intel. Gotcha: presence ≠ execution; corroborate with Prefetch/ShimCache.
AppCompatCacheParser -f /data/SYSTEM --csv /data --csvf _shimcache.csvpython2 /opt/appcompatprocessor/AppCompatProcessor.py case.db --load /data/hosts/
python2 /opt/appcompatprocessor/AppCompatProcessor.py case.db stompMFTECmd -f '/data/$MFT' --csv /data --csvf _mft.csv
MFTECmd -f '/data/$J' --csv /data --csvf _usn.csvReading it: compare $STANDARD_INFO vs $FILE_NAME timestamps → spot timestomping. Gotcha: quote '$MFT' so the shell doesn't treat $M as a variable.
mmls /data/disk.dd # partitions + offsets
fls -r -o 2048 /data/disk.dd # recursive listing (offset from mmls)
icat -o 2048 /data/disk.dd 12345 > /data/file.out # extract by inode
tsk_recover -e -o 2048 /data/disk.dd /data/recovered # recover ALL incl. deletedGotcha: .E01 images — convert/mount first, or work on a raw .dd.
regripper -r /data/SYSTEM -f system > /data/_system.txt
regripper -r /data/NTUSER.DAT -f ntuser > /data/_ntuser.txt
regripper -r /data/SOFTWARE -p runkeys # one pluginls /opt/eztools/RECmd/BatchExamples/ # see available batch files
RECmd --d /data --bn /opt/eztools/RECmd/BatchExamples/SoftwareASEPs.reb --csv /data # persistence (ASEPs)
RECmd -f /data/NTUSER.DAT --sa "RecentDocs" # one-off search across keys/valuesSBECmdShellBags (folders browsed, incl. deleted) ·RBCmdRecycle Bin ($I) ·LECmdLNK ·JLECmdJump Lists ·SrumECmdSRUM (per-app net/runtime ~30 days) ·WxTCmdWindows Timeline ·SumECmdSUM access logs ·RecentFileCacheParser·VSCMountmount Volume Shadow Copies ·bstringsregex string search.SrumECmd -f /data/SRUDB.dat -r /data/SOFTWARE --csv /data SBECmd -d /data --csv /data
Symbols for Windows/Mac/Linux are baked in (~900 MB) → identifies the kernel and runs offline on any standard dump.
vol -f /data/mem.raw windows.info # ALWAYS first: confirm OS/build
vol -f /data/mem.raw windows.pslist # processes
vol -f /data/mem.raw windows.pstree # parent/child (spot suspicious parents)
vol -f /data/mem.raw windows.netscan # network connections
vol -f /data/mem.raw windows.malfind # injected/hidden code
vol -f /data/mem.raw windows.cmdline # process command lines
vol -f /data/mem.raw windows.dlllist --pid 1234
vol -f /data/mem.raw windows.dumpfiles --pid 1234 # carve a process's files
vol -f /data/mem.raw windows.hashdump # local hashesSwap windows. → linux. / mac. for those dumps. Reading it: start at pstree (odd parent→child), then netscan + malfind + cmdline. Gotcha: the dump must be a full physical memory image, not a pagefile/hiberfil alone.
capa-offline /data/suspicious.exe
capa-offline -v /data/sample.dll # verbose: rules + addressesOutput groups capabilities (e.g., "encrypt data using RC4", "create a service", "inject process") → fast read on intent without running it.
floss /data/sample.exe > /data/_floss.txtyara -r /opt/yara-rules/index.yar /data # community set
yara -r /opt/yara-signature-base/index.yar -s /data/sample.exe # Neo23x0; -s shows matched stringsoledump /data/invoice.doc # list streams/macros; then: oledump -s A4 -v /data/invoice.doc
pdfid /data/file.pdf # quick PDF risk triage (JS/OpenAction)
pdf-parser -a /data/file.pdf # dig into objects/streams
emldump /data/phish.eml # analyze an emailexiftool /data/photo.jpg
exiftool -r -csv /data/images/ > /data/_meta.csvWindows triage collection (KAPE output): chainsaw hunt + hayabusa csv-timeline → narrow the timeframe → PECmd/AmcacheParser/AppCompatCacheParser for execution → regripper/RECmd for persistence → MFTECmd for the file timeline around the incident → pivot on the malicious binary's SHA1/path.
Memory dump: vol windows.info → windows.pstree/netscan/malfind/cmdline → windows.dumpfiles to carve the suspicious process → capa-offline + floss + yara on the carved file.
Suspicious file/doc: exiftool (origin) → capa-offline (capabilities) → floss/yara (IOCs/family); Office/PDF → oledump/pdfid/pdf-parser; pivot any extracted C2/hash into your event-log and memory findings.
Full disk image: mmls → fls/tsk_recover (recover incl. deleted) → bstrings/yara on recovered files → mount/extract artifacts and run the Windows tools above.
Pivoting — connecting the dots across tools: the goal is one coherent story. Take an IOC from any tool and chase it through the others:
- A SHA1 from
AmcacheParser→yara/capathe binary, and grep it across other hosts' Amcache. - A filename/path from
chainsaw→ find it inMFTECmd(when it landed) andPECmd(when it ran). - A process from
vol windows.pstree→ itscmdline, itsnetscanconnections, thendumpfilesand analyze. - A C2 IP/domain from
floss/netscan→ search the event logs (chainsaw search) and proxy/SRUM data. Build a timeline by merging the CSVs (sort by timestamp) — that's your incident narrative.
This container analyzes files; it does not sandbox execution. Do not run suspect samples. Treat the analysis box as untrusted:
- Work on an isolated/air-gapped host or disposable VM.
- The
--rmcontainer is ephemeral, but/datais your real folder — keep samples zipped/password-protected (infected) until you intentionally analyze them. - Don't mount sensitive host folders; mount only the case folder.
$MFT: No such file→ quote it:'/data/$MFT'(shell ate the$M).- Permission denied writing to
/data→ the container runs as root; output is root-owned on the host.sudo chown -R $USER:$USER .after, or run docker with--user $(id -u):$(id -g). - EZ tool prints nothing → point
-fat the exact artifact, or-d /datafor a folder; check the path exists inside/data. volcan't find symbols → confirm it's a full physical memory image; runwindows.infofirst to see what it detected.docker: permission denied→ add yourself to thedockergroup or usesudo.- Large image won't
docker load→ ensure all parts downloaded and reassembled (sha256sumthe reassembled tar.gz against the release note).
- Prefetch (
.pf) — Windows speeds up app launches by caching them; each file proves an executable ran, when, and how many times. - Amcache.hve — registry hive logging programs that have existed/run, with SHA1 hashes — great for IOC pivoting.
- ShimCache / AppCompatCache — in the
SYSTEMhive; the app-compatibility engine records executables the OS saw (path + last-modified), even if never run. $MFT— NTFS Master File Table; one record per file with names, sizes, and timestamps — the backbone of a file-system timeline.- USN Journal (
$J) — a rolling log of file create/rename/delete changes — shows what happened to files recently. - ShellBags — registry record of folders a user opened in Explorer (incl. on removable/deleted volumes).
- SRUM (
SRUDB.dat) — System Resource Usage Monitor; per-app network bytes + runtime for the last ~30 days — great for data-exfil sizing. - Jump Lists / LNK — recently-opened files per app, with the source path/volume (USBs, network shares).
- Event logs (
.evtx) — Windows' structured logs (logons, process creation, services, PowerShell…) — the primary attacker-activity source.
- Triage collection (recommended): run KAPE (Kroll Artifact Parser/Extractor) with the
!SANS_Triagetarget on the suspect host → it grabs event logs,$MFT, hives, Prefetch, etc. into one folder. Mount that folder as/dataand go. .E01/.AFF4disk images: the Sleuth Kit tools here expect raw images. Convert first on your host:ewfexport image.E01→image.raw, or mount the E01 and re-image to.dd. (Plain.dd/.rawimages work directly.)- Memory: capture with WinPMEM/DumpIt/AVML → a raw physical memory image, then
vol -f /data/mem.raw windows.info.
Add your own tools or rules without losing offline-ness — layer on top:
FROM dfir-aio:v4
# example: add your own YARA rules so they're baked in
COPY my-rules/ /opt/my-yara/
RUN find /opt/my-yara -name '*.yar' -printf 'include "%p"\n' > /opt/my-yara/index.yardocker build -t dfir-aio:custom .Bundle any rule/signature set the same way (copy it in at build time) so the tool never needs the internet at runtime.
dfir-aio/dfir-aio:v1— core kit (Chainsaw, Hayabusa, EZ Tools, Volatility+symbols, Sleuth Kit, YARA, AppCompatProcessor).dfir-aio:v4(recommended) — everything in v1 plus capa(+rules), FLOSS, RegRipper, regipy, Didier Stevens suite, exiftool, Neo23x0 YARA. Both are published as GitHub releases; v1 stays available.
Event logs: Chainsaw(+Sigma), Hayabusa(+rules), EvtxECmd · Execution: PECmd, AmcacheParser, AppCompatCacheParser, AppCompatProcessor · Filesystem: MFTECmd, Sleuth Kit · Registry/user: RegRipper, RECmd, regipy, SBECmd, RBCmd, LECmd, JLECmd, SrumECmd, SumECmd, WxTCmd, RecentFileCacheParser, VSCMount, bstrings · Memory: Volatility 3 (+ win/mac/linux symbols) · Malware/docs: capa(+rules), FLOSS, YARA (Yara-Rules + Neo23x0), Didier Stevens suite, exiftool.
Everything offline & self-contained. Inside the container, dfir reprints the menu. Reports go to /data.