/PowerForensics

PowerForensics provides an all in one platform for live disk forensic analysis
  1. C# 71.7%
  2. PowerShell 28.2%
  3. Batchfile 0.1%
C# PowerShell Batchfile
Clone or download

Clone with HTTPS

Use Git or checkout with SVN using the web URL.

Open in Desktop Download ZIP
Find file
Switch branches/tags
Nothing to show
Latest commit 9640bf5 Apr 20, 2017 @jaredcatkinson jaredcatkinson committed on GitHub Merge pull request #147 from davehull/AddSHA256 
AddSHA256:Adds support for .gethash("SHA256")
Permalink
Failed to load latest commit information.
Images Added FAT file system support! Dec 29, 2016
Modules/PowerForensics Made index.md point to svg image instead of png Dec 29, 2016
docs Made index.md point to svg image instead of png Dec 29, 2016
lib Made index.md point to svg image instead of png Dec 29, 2016
src AddSHA256:Adds support for .gethash("SHA256") Apr 14, 2017
.gitignore Added PowerForensics Logos Nov 13, 2016
LICENSE.md Added instructions for joining our slack channel Dec 2, 2016
PowerForensics.sln Working on project layout. Nov 29, 2016
README.md smaller images :-) Dec 3, 2016
appveyor.yml welp.... Dec 13, 2016
mkdocs.yml Added FAT file system support! Dec 29, 2016

README.md

PowerForensics - PowerShell Digital Forensics

Developed by @jaredcatkinson

Overview

The purpose of PowerForensics is to provide an all inclusive framework for hard drive forensic analysis. PowerForensics currently supports NTFS and FAT file systems, and work has begun on Extended File System and HFS+ support.

All PowerForensics documentation has been moved to Read The Docs.

Detailed instructions for installing PowerForensics can be found here.

Public API

PowerForensics is built on a C# Class Library (Assembly) that provides a public API for forensic tasks. The public API provides a modular framework for adding to the capabilities exposed by the PowerForensics module. All of this module's cmdlets are built on this public API and tasks can easily be expanded upon to create new cmdlets. API documentation can be found here.