Windows Forensics Toolkit

curated by SkillMD · plugin · 6 skills

For digital forensics analysts investigating Windows systems using registry artifacts, prefetch, and event logs.

Install the whole plugin (CLI)

npx skillmds add mukul975/analyzing-windows-shellbag-artifacts
npx skillmds add mukul975/analyzing-windows-prefetch-with-python
npx skillmds add mukul975/analyzing-windows-lnk-files-for-artifacts
npx skillmds add mukul975/analyzing-prefetch-files-for-execution-history
npx skillmds add zhaoxuya520/digital-forensics
npx skillmds add zhaoxuya520/browser-automation

⬇ Download

Skills in this plugin

▌
analyzing-windows-shellbag-artifacts · mukul975 bundle
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

24.6k
repo stars
▌
analyzing-windows-prefetch-with-python · mukul975 bundle
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.

24.6k
repo stars
▌
analyzing-windows-lnk-files-for-artifacts · mukul975 bundle
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

24.6k
repo stars
▌
analyzing-prefetch-files-for-execution-history · mukul975 bundle
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

24.6k
repo stars
▌
digital-forensics · zhaoxuya520 bundle
Guides authorized digital forensics and incident response workflows including memory dump analysis, disk timeline creation, PCAP investigation, and artifact triage with evidence preservation.

12.8k
repo stars
▌
browser-automation · zhaoxuya520 bundle
Unified automation entry point covering browser automation with Playwright and Windows desktop app automation with OpenReverse for GUI interaction, network capture, and reverse engineering workflows.

12.8k
repo stars