Packs

1 pack

Windows Forensics Toolkit

For digital forensics analysts investigating Windows systems using registry artifacts, prefetch, and event logs.

6 skills · pack

Results for “windows-artifacts”

11 skills

parsing-artifacts-with-eric-zimmerman-tools

Parse Windows forensic artifacts including registry, prefetch, shellbags, MFT, and event logs using Eric Zimmerman's tools and analyze results in Timeline Explorer.

24.6k · bundle

extracting-memory-artifacts-with-rekall

Analyze Windows memory dumps for signs of compromise using the Rekall memory forensics framework, including process injection, hidden processes, and rootkit detection.

24.6k · bundle

analyzing-windows-shellbag-artifacts

Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.

24.6k · bundle

analyzing-windows-lnk-files-for-artifacts

Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.

24.6k · bundle

More results

analyzing-prefetch-files-for-execution-history

Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.

24.6k · bundle

extracting-windows-event-logs-artifacts

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

24.6k · bundle

performing-windows-artifact-analysis-with-eric-zimmerman-too

Parse and analyze Windows forensic artifacts including MFT, registry hives, prefetch files, event logs, LNK files, and jump lists using Eric Zimmerman's EZ Tools suite and KAPE.

24.6k · bundle

analyzing-lnk-file-and-jump-list-artifacts

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing.

24.6k · bundle

graphify-windows

Builds a navigable knowledge graph from any folder of files, with community detection, an audit trail, and outputs including interactive HTML, GraphRAG-ready JSON, and a plain-language report.

investigating-ransomware-attack-artifacts

Identify, collect, and analyze ransomware attack artifacts to determine the variant, initial access vector, encryption scope, and recovery options.

24.6k · bundle

performing-memory-forensics-with-volatility3-plugins

Analyze memory dumps using Volatility3 plugins to detect injected code, rootkits, credential theft, and malware artifacts in Windows, Linux, and macOS memory images.

24.6k · bundle