README.md

Windows Forensics

• My Notes: Windows Beginnings (Easy to check registry locations)
• My Windows Forensics Cheat Sheet - artifacts and traige order
• Active Directory
• Kerberoasting (SpectreOps 4/8/20)
• My USB Info
• The Windows Tools and Artifacts: "The Definative Compendium" and DB of Windows Artifacts Github LINK
• 5/22/20 Magnet Forensics: Emoting Over Emotet and Maldoc - Lots of step-by-steps using tools to analyze different types of malicious docs. Check out Malwareoverview, Didier Stevens' Blog and Tools Suite, and Lazy Office Analyzer.
• 5/28/20 Magnet Forensics: Creating a Digital Forensic Workflow to Combat Data Exfiltration - Unique look on DF investigation. USB (Case 3) and Final Workflow are the highlights.
• 9/2020 GRIMMCon0x2: How to Build a SOC
• System.Speech PowerShell idea

Tools and Scripts

• Windows Registry lookup bash script
• Windows Management Interface (WMI)
• Windows GPO Management

Practice Drives

• https://www.forensicfocus.com/challenges-and-images/
• https://www.cfreds.nist.gov/

Virtualization Hints

From VMware to Vbox: ovftool “C:\Users\NAME\Documents\Virtual Machines\Windows 7 x64\Windows 7 x64.vmx” C:\Users\NAME\export.ovf