Dfir-toolkit Plugin
CLI tools for forensic investigation of Windows artifacts.
Commands
Operations
dfir-toolkit artifact analyze— analyze artifact via dfir-toolkitdfir-toolkit artifact extract— extract artifact via dfir-toolkitdfir-toolkit registry parse— parse registry via dfir-toolkitdfir-toolkit event-log parse— parse event-log via dfir-toolkitdfir-toolkit timeline generate— generate timeline via dfir-toolkitdfir-toolkit report generate— generate report via dfir-toolkitdfir-toolkit config show— show config via dfir-toolkit
Usage Examples
- "dfir-toolkit --help"
- "dfir-toolkit "
Installation
cargo install dfir-toolkit
Examples
dfir-toolkit --version
dfir-toolkit --help
Key Features
- forensics\n- windows\n- security