Skip to content
View sujayadkesar's full-sized avatar
⚛️
learning
⚛️
learning
99 followers · 79 following

Achievements

Achievement: Starstruckx2Achievement: Pull Sharkx2Achievement: QuickdrawAchievement: YOLO

Achievements

Achievement: Starstruckx2Achievement: Pull Sharkx2Achievement: QuickdrawAchievement: YOLO

Block or report sujayadkesar

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
sujayadkesar/README.md

Sujay Adkesar — Digital Forensics & Incident Response. DFIR Analyst building open-source tools for Windows and mobile forensics and incident response.

LinkedIn — sujay-adkesar Blog — thelocalh0st.com


§ 01 — Examiner profile

Casework: Windows endpoints, mobile and connected devices, incident response, examination automation. Principles: read-only always; every fact has a source; validated, not assumed; automate the routine.


§ 02 — Evidence locker

Exhibit A — Windows Forensic Automation: load a disk image, pick the type of case, and get answers, every parsed artifact and a court-ready report. 96 artifact types, 9 case profiles, 103 of 103 validation checks against NIST CFReDS and DFIR Madness.

Exhibit B — Connected Phone Forensics: find every phone that was connected to a computer, what it left there, and exactly where each fact came from. 23 parsers, 8 connection types, Windows, macOS and Linux hosts.

Exhibit C — PhonePe Forensics: a local DFIR workstation for PhonePe iOS extractions with cross-database correlation, a unified timeline and UPI fraud hunting. Exhibit D — VSCExplorer: find, mount and browse Volume Shadow Copies inside E01 and RAW images, BitLocker-encrypted ones included.

Exhibit E — DFIR Agent Builder: a desktop wizard that compiles one self-contained Rust triage collector with write-only S3 upload, ready for GPO deployment. Exhibit F — DFIR Autopilot: extracts, parses and analyses Windows artifacts with pluggable agents and a local LLM, then writes the case report.

More from the locker
Exhibit What it does ★
FAEP One-click artifact extraction and parsing from E01 images (RegRipper, EZ Tools, Hindsight) 1
RDP-BitmapCache_Parser Rebuilds on-screen imagery from RDP bitmap cache files 1
ForensicVault Rapid artifact acquisition from a USB drive 0
cybersecurity-resources Curated cybersecurity learning resources 328
Linux-Privilege-Escalation Linux privilege escalation, from kernel exploits to cron jobs 61
web-dork Google dorks for web-app recon and bug bounty 4
reverse-shell-generator Reverse-shell payload generator 7
auto-rec0n Automates the reconnaissance phase of a penetration test 9

§ 03 — Field kit

Artifacts my tools parse and the forensic toolchain I work in: EnCase, Magnet AXIOM, Cellebrite, Belkasoft, FTK, Autopsy, Inspector, Tableau, Digital Collector, UFADE, CrowdStrike Falcon, Cado, KAPE, Velociraptor, EZ Tools, RegRipper, Hayabusa, Chainsaw, Hindsight, iLEAPP and mac_apt.


§ 04 — Case log

Live GitHub numbers: public repositories, original work, stars earned, followers and the most-starred repository, refreshed daily.

Field notes · from thelocalh0st.com

Date Field note
2026-10-31 The Upgrade Ate My Timeline: Windows Feature Update Forensics
2026-10-31 Did the Agent Do It? Incident Response for AI Coding Agents
2026-10-23 One Reported Email, Two Payloads: A SOC Analyst's Email Forensics Playbook
2026-10-22 The Browser Kept a Receipt: Proving a Download Was the Same File with ETag
2026-10-17 Where Is This Access Point? Geolocating a WiFi BSSID, the Forensic Way

End of case file.

Got an artifact your tools can't read? Open an issue on any repo, or find me on LinkedIn.

Profile views

Pinned Loading

  1. vscexplorer vscexplorer Public

    Volume Shadow Copy Explorer

    Python 18 5