https://github.com/Invoke-IR/PowerForensics

PowerForensics provides an all in one platform for live disk forensic analysis
https://github.com/Invoke-IR/PowerForensics

Last synced: 7 months ago
JSON representation

PowerForensics provides an all in one platform for live disk forensic analysis

• Host: GitHub
• URL: https://github.com/Invoke-IR/PowerForensics
• Owner: Invoke-IR
• License: mit
• Created: 2015-03-07T17:12:19.000Z (over 10 years ago)
• Default Branch: master
• Last Pushed: 2023-11-16T10:31:37.000Z (almost 2 years ago)
• Last Synced: 2024-10-29T17:39:48.294Z (about 1 year ago)
• Language: C#
• Homepage:
• Size: 16.1 MB
• Stars: 1,385
• Watchers: 158
• Forks: 274
• Open Issues: 64
• Metadata Files:
  • Readme: README.md
  • License: LICENSE.md

Awesome Lists containing this project

• awesome-cybersecurity-blueteam - PowerForensics - All in one PowerShell-based platform to perform live hard disk forensic analysis. (Security monitoring / Threat hunting)
• awesome-incident-response - PowerForensics - Live disk forensics platform, using PowerShell. (IR Tools Collection / Windows Evidence Collection)
• ForensicsTools - PowerForensics - PowerForensics is a framework for live disk forensic analysis (Challenges / Frameworks)
• awesome-powershell - PowerForensics - PowerForensics provides an all in one platform for live disk forensic analysis. 🚧 (🛡️ Security)
• awesome-forensics - PowerForensics - PowerForensics is a framework for live disk forensic analysis (Tools / Frameworks)
• Awesome-Forensics - PowerForensics - PowerForensics is a framework for live disk forensic analysis (Tools / Frameworks)
• awesome-csirt - PowerShell - Live disk forensics platform
• awesome-cybersecurity-blueteam-cn - PowerForensics - 基于PowerShell，用于实时硬盘取证分析的多合一平台 (安全监控 / 威胁狩猎)
• fucking-awesome-incident-response - PowerForensics - Live disk forensics platform, using PowerShell. (IR Tools Collection / Windows Evidence Collection)
• awesome-incident-response - PowerForensics - Live disk forensics platform, using PowerShell. (IR tools Collection / Windows Evidence Collection)

README

          


  



PowerForensics - PowerShell Digital Forensics


Developed by @jaredcatkinson



[![Build status](https://ci.appveyor.com/api/projects/status/l8rmlql34xwyvwsc/branch/master?svg=true)](https://ci.appveyor.com/project/Invoke-IR/powerforensics/branch/master)

[![docs status](https://readthedocs.org/projects/powerforensics/badge/?version=latest)](https://powerforensics.readthedocs.io/en/latest/)

[![waffle ready](https://badge.waffle.io/Invoke-IR/PowerForensics.png?label=ready&title=Ready)](https://waffle.io/Invoke-IR/PowerForensics)

[![waffle in progress](https://badge.waffle.io/Invoke-IR/PowerForensics.png?label=in%20progress&title=In%20Progress)](https://waffle.io/Invoke-IR/PowerForensics)

## Overview

The purpose of PowerForensics is to provide an all inclusive framework for hard drive forensic analysis.

PowerForensics currently supports NTFS and FAT file systems, and work has begun on Extended File System and HFS+ support.

All PowerForensics documentation has been moved to Read The Docs.

Detailed instructions for installing PowerForensics can be found here.

## Public API

PowerForensics is built on a C# Class Library (Assembly) that provides a public API for forensic tasks.

The public API provides a modular framework for adding to the capabilities exposed by the PowerForensics module.

All of this module's cmdlets are built on this public API and tasks can easily be expanded upon to create new cmdlets.

API documentation can be found here.