Added Active Directory database artifact definition (#527)

ForensicArtifacts · Sep 14, 2022 · facefa9 · facefa9
1 parent 61c4d43
commit facefa9
Showing 1 changed file with 10 additions and 0 deletions.
diff --git a/data/windows.yaml b/data/windows.yaml
@@ -11,6 +11,16 @@ sources:
 supported_os: [Windows]
 urls: ['https://artifacts-kb.readthedocs.io/en/latest/sources/windows/ActiveDesktop.html']
 ---
+name: WindowsActiveDirectoryDatabase
+doc: Windows Active Directory data store file.
+sources:
+- type: FILE
+  attributes:
+    paths: ['%%environ_systemroot%%\ntds\ntds.dit']
+    separator: '\'
+supported_os: [Windows]
+urls: ['https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc772829(v=ws.10)']
+---
 name: WindowsActivitiesCacheDatabase
 doc: SQLite database containing the Windows activities cache.
 sources: