DFIR Tools and Resources

Hawk Forensics is a PowerShell module to quickly collect data from M365 and Azure for analysis.

Links

• Website: https://cloudforensicator.com/
• GitHub: https://github.com/T0pCyber/hawk

KAPE by Eric Zimmerman. KAPE is a triaging tool that collects and parses artifacts quickly.

Links

• Website: https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape
• GitHub: https://github.com/EricZimmerman/KapeFiles
• Documentation: https://ericzimmerman.github.io/KapeDocs/#!index.md

Notes

Basic KAPE collection of C drive with the SANs triage compound target and output as VHD:

.\kape.exe --tsource C: --tdest C:\Temp --target !SANS_Triage --vhd <Insert VHD Name> --gui

Hayabusa is a Windows event log fast forensics timeline generator and threat hunting tool.

Links

• Github: https://github.com/Yamato-Security/hayabusa

Notes csv-timeline output from directory:

.\hayabusa.exe csv-timeline -d {EVTXFileDirectory} -o results.csv

Include HTML report + csv output:

.\hayabusa.exe csv-timeline -d {EVTXFileDirectory} -o results.csv -H results.html

Ntdissector is a tool for parsing records of an NTDS database.

Links

• Website: https://www.synacktiv.com/en/publications/introducing-ntdissector-a-swiss-army-knife-for-your-ntdsdit-files
• Github: https://github.com/synacktiv/ntdissector

Notes Dump all records:

ntdissector -ntds NTDS.dit -system SYSTEM -outputdir /tmp/ntdissector/ -ts -f all

The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples.

Links

• Website: https://www.volatilityfoundation.org/
• GitHub: https://github.com/volatilityfoundation/volatility
• Good quick reference: https://blog.onfvp.com/post/volatility-cheatsheet/

MemProcFS is a powerful memory analysis tool that creates a virtual file system from a memory image. This enhancing the efficiency of memory analysis by centralizing key information into a browsable format accessible through a mounted drive.

Links

• GitHub: https://github.com/ufrisk/MemProcFS
• MemProcFS - This Changes Everything from 13Cubed: https://www.youtube.com/watch?v=hjWVUrf7Obk

Notes Quick Start Commandline:

.\MemProcFS.exe -device $MemoryImage -forensic 1 -license-accept-elastic-license-2-0