Metadata-Version: 2.4
Name: dfir
Version: 0.1.0
Summary: A small, dependency-free command-line toolkit for quick digital forensics and incident response triage.
Author-email: DyNooob <i@nooob.top>
Maintainer-email: DyNooob <i@nooob.top>
License-Expression: MIT
Project-URL: Homepage, https://github.com/DyNooob/DFIR
Project-URL: Repository, https://github.com/DyNooob/DFIR
Project-URL: Source, https://github.com/DyNooob/DFIR
Project-URL: Issues, https://github.com/DyNooob/DFIR/issues
Project-URL: Changelog, https://github.com/DyNooob/DFIR/blob/main/CHANGELOG.md
Keywords: dfir,digital-forensics,incident-response,forensics,triage,ioc
Classifier: Development Status :: 3 - Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Information Technology
Classifier: Intended Audience :: Science/Research
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# dfir

[![PyPI version](https://img.shields.io/pypi/v/dfir.svg)](https://pypi.org/project/dfir/)
[![Python versions](https://img.shields.io/pypi/pyversions/dfir.svg)](https://pypi.org/project/dfir/)
[![CI](https://github.com/DyNooob/DFIR/actions/workflows/ci.yml/badge.svg)](https://github.com/DyNooob/DFIR/actions/workflows/ci.yml)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)

**dfir** is a small, dependency-free command-line toolkit for quick digital forensics and incident response triage.

It is intentionally focused on fast, local inspection of files and directories before you move into heavier forensic tooling.

> Created and maintained by **[DyNooob](https://github.com/DyNooob)**.

## Features

- **No runtime dependencies** — pure standard library, runs anywhere Python 3.9+ runs.
- **Read-only by default** — inspects evidence, never modifies it.
- **Human-readable and JSON output** — easy ad-hoc use and automation.
- **Cross-platform** — Windows, Linux, and macOS.

## Install

From PyPI:

```bash
pip install dfir
```

From source:

```bash
python -m pip install .
```

## Commands

### Hash a file or directory

```bash
dfir hash suspicious.bin

dfir hash evidence/ --recursive

dfir hash evidence/ --recursive --json
```

Calculates MD5, SHA-1, SHA-256, and SHA-512 in one pass.

### Inspect metadata

```bash
dfir info suspicious.bin
```

Shows size, timestamps, permissions, file type hints, and basic path information.

### Calculate Shannon entropy

```bash
dfir entropy suspicious.bin
```

Useful as a quick signal for compressed, encrypted, packed, or otherwise high-entropy data.

### Extract printable strings

```bash
dfir strings suspicious.bin

dfir strings suspicious.bin --min-length 8
```

Extracts ASCII and UTF-16LE printable strings.

### Extract common IOCs

```bash
dfir ioc logfile.txt

dfir ioc suspicious.bin --json
```

Recognizes common indicators including URLs, email addresses, IPv4 addresses, domains, and MD5/SHA-1/SHA-256 hashes.

### Quick triage

```bash
dfir triage suspicious.bin

dfir triage suspicious.bin --json
```

Runs metadata, hashing, entropy, and IOC extraction together and produces a compact report.

## Design goals

- No runtime dependencies.
- Safe by default: reads evidence but does not modify it.
- Cross-platform Python 3.9+ support.
- Human-readable output plus JSON for automation.
- Small enough to use during initial triage without a large toolchain.

## Build and publish

This repository ships two GitHub Actions workflows:

- **`ci.yml`** — runs the test suite on Python 3.9–3.13 for every push and pull request.
- **`publish.yml`** — builds the package and publishes it to PyPI. It runs on tagged releases and reads the token from the repository secret `PYPI_API_TOKEN`.

To publish locally:

```bash
python -m pip install --upgrade build twine
python -m build
python -m twine check dist/*
python -m twine upload dist/*
```

After publishing:

```bash
pip install dfir
dfir --version
```

## Development

Run the tests:

```bash
PYTHONPATH=src python -m unittest discover -s tests -v
```

Try the CLI directly from the repository:

```bash
PYTHONPATH=src python -m dfir --help
```

On PowerShell:

```powershell
$env:PYTHONPATH = "src"
python -m dfir --help
```

## License

Released under the [MIT License](LICENSE) by **DyNooob**.
