A module to automate differntial analysis with VMs.
It has been developed in the course of my master thesis.
More Documentation, use cases etc. to come!
The subdirectory ./HelperScripts
stores scripts that are used for application specific tasks.
At the moment this module is neither published in the PSGallery nor available as a NuGet package, but this is on the roadmap. Until then you have to perform a good old manual installation
- Clone the repository
- Copy the folder
PowerForensicator
to the respective configured paths in yourPSModulePath
environment variable.
# Copy module to all paths
$env:PSModulePath.Split(":") | % { Copy-Item "PowerForensicator" -Destination $_ -Recurse -Force -Verbose }
# Import module and test
Import-Module PowerForensicator
Get-Command -Module PowerForensicator
- Clone the repository
- Copy the folder
PowerForensicator
to the respective configured paths in yourPSModulePath
environment variable.
# Copy module to all paths
$env:PSModulePath.Split(";") | % { Copy-Item "PowerForensicator" -Destination $_ -Recurse -Force -Verbose }
# Import module and test
Import-Module PowerForensicator
Get-Command -Module PowerForensicator
- requires
Vbox4PowerShell
- fiwalk + idifference2 is used
- framework iself uses docker for that
- you can also use
fiwalk
andidifference2.py
locally. Please be aware that you need to check the prerequesites yourself for that! The script will only check if everything is there. Bothfiwalk
andidifference2.py
must be found through yourPATH
variable! - EASIEST way is to just use docker (which is default)
- runs faster on ubuntu than windows
Roadmap & Todos:
- Resolve
#todo:
comments across the scripts/ cmdlets. - Implement DFXML python as a git submodule
- Create a template for analysis reports
- Add functionality for differential analysis of memory dumps
- Implement automated usage of volatility or rekall
- Streamline
Invoke-ActionStateFileExport
- use functions
New-FiwalkXML
andInvoke-Idifference
- refactor
$RAWFileName
inInvoke-ActionStateFileExport
to$ACTIONRawFile
- use functions
Format-ActionEvidence
- Add second parameterset with
filepath
to directly address idiff files
- Add second parameterset with
- Add a script named something like
Invoke-Windows10ForensicPreparation
which performs actions on a fresh Windows 10 VM in order to prepare it for forensic investigations.- Install the Sysinternal tools on it and add them to path
- Disable Windows Defender
- List goes on..
- Exchange hardcoded 300seconds timeout in
Wait-PodDeployment
for a parameter like$TimeOut