Skip to content
PowerShell script utilized to pull several forensic artifacts from a live Win7 and WinXP system without WINRM.
Branch: master
Clone or download
n3l5 the Habben version
Added collection of the CCM_RecentlyUsedApps from SCCM's software
metering history.
Latest commit 7b4c41b Apr 6, 2017
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
README.md the Habben version Apr 6, 2017
irfartpull.ps1 the Habben version Apr 6, 2017

README.md


() | /\ | | | | | _ _ | | / \ _ | | _ __ _ _| | | | | '_| / /\ \ | '| _| ' | | | | | | | | | | | / ____ | | | || |) | || | | | ||| ||// __| _| .__/ _,||| | |
|
|

IR Forensic ARTifact pull (irFArtpull)

DESCRIPTION:

irFArtpull is a PowerShell script utilized to pull several forensic artifacts from a live Windows 7, 8, Server 2008, and Server 2012 systems on your network.

Artifacts it grabs:

  • Disk Information
  • System Information
  • User Information
  • Network Configuration
  • Netstat info
  • Route Table, ARP Table, DNS Cache, HOSTS file
  • Running Processes
  • Services
  • Event Logs (System, Security, Application)
  • Prefetch Files
  • CCM_RecentlyUsedApps
  • $MFT
  • NTFS $LogFile
  • USN Journal
  • Amcache.hve
  • Registry Files
  • User NTUSER.dat files (from user profiles used within last 15 days)
  • Internet History Files (IE, Firefox, Chrome from user profiles used within last 15 days)

When done collecting the artifacts, it will 7zip the data and yank the info off the box for off-line analysis.

NOTEs:

  • All testing done on PowerShell v4+
  • Requires RawCopy.exe (x32) & RawCopy64.exe for the extraction of "in use" files. Version: RawCopy v1.0.0.15 (latest as of writing)
  • Requires ExtractUsnJrnl for the extraction of the NTFS change journal ($UsnJrnl)
  • Autorunsc - Command line version of Autoruns; shows the programs configure to run during login, system bootup, and application plug-ins.
  • Requires 7za.exe (7zip cmd line) for compression w/ password protection

Assumed Directories:

  • c:\windows\temp\IR - Where the work will be done (no need to create)

***As expected: Must be ran a user that will have Admin creds on the remote system. The assumption is that the target system is part of a domain.

LINKs:

irFARTpull main - https://github.com/n3l5/irFARTpull

Links to required tools:

Various tools for analysis of the artifacts:

You can’t perform that action at this time.