What is YARA-Forensics
A library and tools to access and manipulate VMware Virtual Disk (VMDK) files.
Yara: The Versatile Tool for Pattern Matching
Yara is an essential pattern matching tool for malware researchers and others in the field. Essentially, Yara enables us to scan files using either textual or binary patterns. This capability allows us to leverage Yara's potential effectively, particularly in forensic investigations.
The repository is organized into two main folders
The repository consists of two primary folders: file and raw.
Understanding the Rules in the File
The rules in the file folder primarily focus on detecting magic in standalone files. In contrast, the rules located within the raw folder are specifically designed to identify magic in raw files or dump files.
The main difference is the...
The primary distinction lies in the magic offset, which is typically located at 0x0 in files. For guidance on contributions, please refer to CONTRIBUTING.md.
YARA-Forensics Reviews
No reviews yet.
