{"id":13773588,"url":"https://github.com/securityjoes/ForensicMiner","last_synced_at":"2025-05-11T05:34:59.921Z","repository":{"id":208065425,"uuid":"720716930","full_name":"securityjoes/ForensicMiner","owner":"securityjoes","description":"A really good DFIR automation for collecting and analyzing evidence designed for cybersecurity professionals.","archived":false,"fork":false,"pushed_at":"2024-05-21T06:33:07.000Z","size":5124,"stargazers_count":134,"open_issues_count":2,"forks_count":17,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-05-21T07:50:57.118Z","etag":null,"topics":["automation","cortex","crowdstrike","cyber","dfir","edr","fast","forensics","ir","mdr","powershell","security","soc","xdr"],"latest_commit_sha":null,"homepage":"http://github.com/YosfanEilay","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/securityjoes.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-11-19T11:32:55.000Z","updated_at":"2024-08-03T17:07:33.870Z","dependencies_parsed_at":"2023-12-03T14:21:30.904Z","dependency_job_id":"4216835f-d9f2-45fd-a2f4-c2f4dc3655a2","html_url":"https://github.com/securityjoes/ForensicMiner","commit_stats":null,"previous_names":["yosfaneilay/forensicminer","securityjoes/forensicminer"],"tags_count":7,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/securityjoes%2FForensicMiner","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/securityjoes%2FForensicMiner/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/securityjoes%2FForensicMiner/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/securityjoes%2FForensicMiner/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/securityjoes","download_url":"https://codeload.github.com/securityjoes/ForensicMiner/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253523688,"owners_count":21921815,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["automation","cortex","crowdstrike","cyber","dfir","edr","fast","forensics","ir","mdr","powershell","security","soc","xdr"],"created_at":"2024-08-03T17:01:17.589Z","updated_at":"2025-05-11T05:34:54.904Z","avatar_url":"https://github.com/securityjoes.png","language":"PowerShell","funding_links":[],"categories":["Tools"],"sub_categories":["Acquisition"],"readme":"# ForensicMiner v1.4\n#### \"ForensicMiner, Redefine DFIR Automations\"\n#### Created \u0026 Maintained by: [Eilay Yosfan](https://github.com/YosfanEilay#-eilay-yosfan)\n![Banner](https://github.com/YosfanEilay/ForensicMiner/assets/132997318/72d572fc-2f43-48dd-a16b-1b545eb6aad6)\n\n## What is ForensicMiner ?\nForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations.\nDesigned for efficiency, it automates artifact and evidence collection from Windows machines. Compatibility\nwith Flacon Crowdstrike RTR and Palo Alto Cortex XDR Live Terminal, along with its swift performance and \nuser-friendly interface, makes ForensicMiner an indispensable asset for investigators navigating the complexities\nof forensic analysis. Streamlined and effective, this tool sets a new standard in the realm of digital forensics.\n\n## How To Install ?\n![How To Install](https://github.com/YosfanEilay/ForensicMiner/assets/132997318/36c30bc3-c9f1-49f7-a3ac-b56c01e53dd1)\n\n#### Know This Before Installation\n* Always install ForensicMiner on \"C:\\\" drive.\n* Always run ForensicMiner as administrator, if not, some things may not work properly.\n* Don't run the tool using Windows PowerShell (x86)! if you do, some things may not work properly.\n* Make sure your PowerShell Execution Policy is on Bypass, if not, scripts could not run on your system.\n  * For more information use this PS Execution Policy Guide - https://www.youtube.com/watch?v=L0fgZ0FJIv0\n\n#### Installation Process - Text Guide\n1. In this GitHub repository, click on \"\u003c\u003e Code,\" and then select \"Download ZIP.\"\n2. Extract \"ForensicMiner\" folder from \"ForensicMiner-main.zip\".\n3. Move \"ForensicMiner\" folder to C:\\\\ drive.\n5. That's it! ForensicMiner is now installed. Enjoy\n\n#### Installation Process - Video Guide\nhttps://github.com/YosfanEilay/ForensicMiner/assets/132997318/e163abfe-0a60-4181-806a-2426cbe26711\n\n### How To Install On Falcon Crowdstrike ?\n#### Installation Process On - Falcon Crowdstrike RTR - Video Guide\nhttps://github.com/YosfanEilay/ForensicMiner/assets/132997318/c0be8264-fc0f-47fc-83ad-fe3e5edf5056\n\n### How To Install On Palo Alto Cortex XDR ?\n### Installation Process On - Palo Alto Cortex XDR - Video Guide\nhttps://github.com/YosfanEilay/ForensicMiner/assets/132997318/397f3e3c-d271-4fd3-8ed5-2072a28d1395\n\n## Quick Start Guide - How To Use ForensicMiner ?\nhttps://github.com/YosfanEilay/ForensicMiner/assets/132997318/0f32bc7c-b4fe-4ac5-88cb-09ea701878bd\nAfter installing ForensicMiner on the machine using the execution of \"FM-Extractor.ps1\" \u003cbr\u003e\nA new folder should be created on the \"C:\\\" drive, called \"ForensicMiner\". \u003cbr\u003e\n\u003cbr\u003e\nNavigate to This folder using the following command:\n```\nPS C:\\\u003e cd ForensicMiner\n```\nAnd now you can execute ForensicMiner menu page to view all available features and options using this command:\n```\nPS C:\\ForensicMiner\u003e .\\ForensicMiner.ps1 -O Menu\n```\n#### Show Menu - Video Guide\nhttps://github.com/YosfanEilay/ForensicMiner/assets/132997318/163c6656-cc14-439c-bc7a-f775d175dd73\n\n### Running Feature Example - RunMRU\nIn this example you will see how ForensicMiner manage to collect all the Run.exe execution history \u003cbr\u003e\nof all the users (Online or Offline) in the machine and log them under \"C:\\ForensicMiner\\MyEvidence\"\n\nhttps://github.com/YosfanEilay/ForensicMiner/assets/132997318/043674b4-20ca-45e2-9ca6-f2218350862a\n\n## Credits Section\n| Name                                 | Why is the credit ?                          |\n| ------------------------------------ | -------------------------------------------- |\n| Ido Naor, Security Joes CEO          | For supporting this project                  |\n| Warren Frame (RamblingCookieMonster) | Using Warre's PSSQLite in ForensicMiner      |\n| Jan Moronia \u0026 Felipe Duarte          | Helping to manage time spent on this project |\n| Nir Avron                            | For letting me test on his machine           |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityjoes%2FForensicMiner","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecurityjoes%2FForensicMiner","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecurityjoes%2FForensicMiner/lists"}