Remote KAPE collection using powershell

Entrepreneuriat Étudiant Européen

FRANZÖSISCH LERNEN · LEARN FRENCH · APRENDER FRANCÉS · APPRENDRE LE FRANÇAIS

SPANISCH LERNEN · LEARN SPANISH · APRENDER ESPAÑOL · APPRENDRE L'ESPAGNOL

ENGLISCH LERNEN · LEARN ENGLISH · APRENDER INGLÉS · APPRENDRE L'ANGLAIS

DEUTSCH LERNEN · LEARN GERMAN · APRENDER ALEMÁN · APPRENDRE L'ALLEMAND

coordinated professionalization of faculties

koko (all) ni (me) .co (and others)

omniscient currencies tokens

actions titles coins

A powershell tool that automate the remote forensic evidence adquisitions (triage) from Remote windows machines, using KAPE tool.

A repo for centralizing ongoing research on the new Windows 10/11 DFIR artifact, EventTranscript.db.

A repository of DFIR-related Mind Maps geared towards the visual learners!

A repo to centralize some of the regular expressions I've found useful over the course of my DFIR career.

A sample VHDX file with multiple verbose examples of forensic and anti-forensics artifacts. Meant to be basic and can be expanded upon. Please add a new issue if you have an idea for something to add.

A collection of powershell scripts that are designed to be ran from a Microsoft Defender for Endpoint Live Response terminal, utilizing open-source tools, such as Kape (Kroll Artifact Parser and Extractor), to forensically acquire and process necessary artifact used in compromise assessments. Additional scripts provide pre-processing automation …

Python 3 Script to parse out iTunes backups

using FTK imager to extract data from disk

Invoke-Forensics provides PowerShell commands to simplify working with the forensic tools KAPE and RegRipper.

A curated list of KAPE-related resources