forensicnomicon 0.5.6

The ForensicNomicon — comprehensive DFIR artifact catalog: UserAssist, Shimcache, Amcache, Prefetch, $MFT, ShellBags, EVTX, NTDS.dit, SAM, SRUM, LNK, Jump Lists + KAPE/Velociraptor/Sigma/MITRE. Zero deps.
Documentation
# Terms of Service

*Last updated: 2026-06-15*

## Licence

forensicnomicon is released under the [Apache License 2.0](https://github.com/SecurityRonin/forensicnomicon/blob/main/LICENSE). You may use, modify, and distribute it subject to the terms of that licence.

## Acceptable Use

You agree to use forensicnomicon only for lawful purposes, including but not limited to:

- Digital forensics investigations on systems you own or are authorised to examine
- Incident response activities within your organisation
- Security research and CTF competitions
- Academic or educational use

## No Warranty

forensicnomicon is provided "as is" without warranty of any kind. Security Ronin Ltd is not liable for any damages arising from use of this software.

## Contact

[security@securityronin.com](mailto:security@securityronin.com)

---

[Privacy Policy](privacy.md) · [Home](index.md) · © 2026 Security Ronin Ltd.