https://github.com/ashemery/windowsdfir

Repository for different Windows DFIR related CMDs, PowerShell CMDlets, etc, plus workshops that I did for different conferences or events.
https://github.com/ashemery/windowsdfir

cmd cmdlets dfir investigations powershell scripts windows

Last synced: 27 days ago
JSON representation

Repository for different Windows DFIR related CMDs, PowerShell CMDlets, etc, plus workshops that I did for different conferences or events.

• Host: GitHub
• URL: https://github.com/ashemery/windowsdfir
• Owner: ashemery
• Created: 2020-02-07T00:11:53.000Z (almost 5 years ago)
• Default Branch: master
• Last Pushed: 2021-07-13T01:56:39.000Z (over 3 years ago)
• Last Synced: 2023-04-04T15:09:05.895Z (over 1 year ago)
• Topics: cmd, cmdlets, dfir, investigations, powershell, scripts, windows
• Language: PowerShell
• Homepage:
• Size: 27.3 KB
• Stars: 62
• Watchers: 5
• Forks: 7
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

        
# Windows DFIR

Repository for different Windows DFIR related CMDs, PowerShell CMDlets, etc, plus workshops that I did for different conferences or events.

### Timestamps in UTC

```Get-ChildItem \ -Force | Select-Object FullName, CreationTimeUTC, LastAccessTimeUTC, LastWriteTimeUTC```

  

### Timestamps in local time

```Get-ChildItem \ -Force | Select-Object FullName, CreationTime, LastAccessTime, LastWriteTime```

### Hash Values (MD5, SHA1, and SHA256)

```Get-FileHash \ -Algorithm MD5 | Format-List```

```Get-FileHash \ -Algorithm SHA1 | Format-List```

```Get-FileHash \ -Algorithm SHA256 | Format-List```

### Find location of executable in PATH (similar to which on Linux Systems)

```where executablename```

### Merge two CSV files

```Get-Content LNK_User1.csv, LNK_User2.csv | Select-Object -Unique | Set-Content -Encoding ASCII LNK_Users.csv```

### Create Symbolic Links to Multiple files. Useful to process files that reside in Known Folders

- Check the file "createSymLinks.ps1" and from where it was found.

- More info about Known Folders: [URL](https://docs.microsoft.com/en-us/windows/win32/shell/known-folders)

## Workshops

- BSides Amman 2021, all files here: [URL](https://github.com/ashemery/WindowsDFIR/tree/master/Workshops/BSidesAmman21)