Home

Awesome


() | __/\ | | | | | _ _ | | / \ _ | | _ __ _ | | | | | '__| / /\ \ | '| | ' | | | | | | | | | | | / ____ | | | || |) | || | | | ||| ||// __| _| .__/ _,||| | |
|_|

IR Forensic ARTifact pull (irFArtpull)

DESCRIPTION:

irFArtpull is a PowerShell script utilized to pull several forensic artifacts from a live Windows 7, 8, Server 2008, and Server 2012 systems on your network.

Artifacts it grabs:

When done collecting the artifacts, it will 7zip the data and yank the info off the box for off-line analysis.

NOTEs:

Assumed Directories:

***As expected: Must be ran a user that will have Admin creds on the remote system. The assumption is that the target system is part of a domain.

LINKs:

irFARTpull main - https://github.com/n3l5/irFARTpull

Links to required tools:

Various tools for analysis of the artifacts: