PowerForensics

1.0.2

A Digital Forensics framework for Windows PowerShell.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name PowerForensics -RequiredVersion 1.0.2

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name PowerForensics -Version 1.0.2

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

jaredatkinson

Copyright

Package Details

Author(s)

JaredAtkinson

Cmdlets

ConvertFrom-BinaryData ConvertTo-ForensicTimeline Copy-ForensicFile Get-ForensicAlternateDataStream Get-ForensicAmcache Get-ForensicAttrDef Get-ForensicBitmap Get-ForensicBootSector Get-ForensicChildItem Get-ForensicContent Get-ForensicEventLog Get-ForensicExplorerTypedPath Get-ForensicFileRecord Get-ForensicFileRecordIndex Get-ForensicFileSlack Get-ForensicGuidPartitionTable Get-ForensicMasterBootRecord Get-ForensicMftSlack Get-ForensicNetworkList Get-ForensicOfficeFileMru Get-ForensicOfficeOutlookCatalog Get-ForensicOfficePlaceMru Get-ForensicOfficeTrustRecord Get-ForensicPartitionTable Get-ForensicPrefetch Get-ForensicRecentFileCache Get-ForensicRegistryKey Get-ForensicRegistryValue Get-ForensicRunKey Get-ForensicRunMru Get-ForensicScheduledJob Get-ForensicShellLink Get-ForensicShimcache Get-ForensicSid Get-ForensicTimeline Get-ForensicTimezone Get-ForensicTypedUrl Get-ForensicUnallocatedSpace Get-ForensicUserAssist Get-ForensicUsnJrnl Get-ForensicUsnJrnlInformation Get-ForensicVolumeBootRecord Get-ForensicVolumeInformation Get-ForensicVolumeName Get-ForensicWindowsSearchHistory Invoke-ForensicDD

Dependencies

This module has no dependencies.

Release Notes

Added 5 cmdlets:
- Get-ForensicOfficeFileMru
- Get-ForensicOfficeOutlookCatalog
- Get-ForensicOfficePlaceMru
- Get-ForensicOfficeTrustRecord
- Get-ForesnicRunKey

A number of bugs fixed and code efficiencies added.

FileList

PowerForensics.nuspec
Antlr4.Runtime.dll
PowerForensics.dll
PowerForensics.pdb
PowerForensics.ps1xml
PowerForensics.psd1
PowerForensics_Types.ps1xml
BinShredDemo\bin.bin
BinShredDemo\binParser.bst
BinShredDemo\bitmap.bst
BinShredDemo\example.tar
BinShredDemo\hello_world.bmp
BinShredDemo\Import-HelloWorldBitmap.ps1
BinShredDemo\tar.bst
BinShredDemo\tar_full.bst
BinShredDemo\wordParser.bst
BinShredDemo\words.bin
en-US\about_binshred.help.txt
en-US\PowerForensics.dll-Help.xml
Tests\PowerForensics.Tests.ps1

Version History

Version	Downloads	Last updated
1.1.1	134,015	1/30/2016
1.0.2 (current version)	150	12/16/2015
1.0.1.4	55	12/4/2015
1.0.1.3	27	12/4/2015
1.0.1.2	39	12/2/2015
1.0.1.1	36	11/30/2015