Forensics Module

The Forensics Module contains the following scripts:

• Get-RegistryHives
• Get-VolatileData
• Get-VolatileandNVData
• Get-MemImage
• Get-NonVolatileData
• Get-UserInfo
• Get-LogOnInfo
• Get-CurrentControlSet
• Get-SIDAD
• Get-SID
• Get-AllForensicData
• Get-SystemUptime
• Set-ForensicsConfig
• Get-ProcessOwner
• Get-NetStat
• Get-SecBrowserHelperObjects

Tools

Some of the scripts use external tools to function. For example, Get-MemImage was written to use winpmem to acquire a memory capture but can also be used with any command line memory tool. Winpmem is located at http://code.google.com/p/volatility/downloads/list **rename binary to winpmem.exe ***

The other tools are hard-coded:

Script Operating Related

     robocopy.exe       Included in the Windows 2003 resource tool kit and located at http://www.microsoft.com/download/en/details.aspx?id=17657

Offline Data

rawcopy.exe 	http://code.google.com/p/mft2csv/downloads/list (ensure you have both RawCopy64.exe and RawCopy.exe)

Getting Started

The first script to use is Set-ForensicsConfig. This sets the location for all script results to be placed and tells the scripts where to look for tools used to copy data.

Dest = directory to put results

Tools = tools directory

Output

A consistent naming convention is used for all script output. Output is written to folders using the following convention:

YYYY-MM-DD_TIME_ComputerName-DataType

So for example, if the Get-UserInfo script is run, its output would be placed in a folder named similar to:

2014-04-15_0913_TSTARK14L-UsersInfo

Script Info

Set-ForensicsConfig – sets location for results and tools

Get-MemImage – Captures an image of live memory from target system

Get-RegistryHives – Copies Registry Hives of target

Get-VolatileData – Copies volatile forensic data: memory, prefetch, process and network info

Get-NonVolatileData – Copies non-volatile forensic data: Logs, registry, group policy, etc.

Get-VolatileandNVData – Copies both Volatile and Non-Volatile data

Get-UserInfo – Captures forensic user data: NTUSER.DAT file, cookies, etc.

Get-AllForensicData - captures all data from the volatile, non-volatile and user info scripts

Get-LogOnInfo – Grabs logon info for target system(s)

Get-CurrentControlSet – Identifies current control set for target(s)

Get-SIDAD – gets SID for user in Active Directory

Get-SID – gets SID for target computer

Get-SystemUptime – identifies system uptime for target computer(s)

Get-ProcessOwner – lists name and owner for any currently running processes on target system

Get-Netstat – gathers netstat info for a system and an IP address (checks to see if a current connection is open)