Forensic Utilities Artifacts

This post documents the method I am using to determine what Artifacts each Forensic Utility Creates.

Welcome to the Forensic Utilities Artifacts Forum This Forum was created as a place for the DFIR

Utility Version: PSLoggedon v1.35 Utility Source: https://download.sysinternals.com/files/PSTools.zip

Utility Version: PSList v1.4 Utility Source: https://download.sysinternals.com/files/PSTools.zip

Utilty Version: Autoruns v13.71 Utility Source: https://download.sysinternals.com/files/Autoruns.zip

Source: https://download.sysinternals.com/files/PSTools.zip Hash: PSInfo Hash MD5 -

Live Response often involved connecting an External USB Drive that contains the Response Software and

Running ANY program will create Artifacts in memory and possibly (likely) on disk. This thread

Source(s): http://nirsoft.net/utils/browsinghistoryview.zip http://nirsoft.net/utils/

Source: http://www.nirsoft.net/utils/userassistview.zip Hash MD5 - f36530f46a34516be38521ee9a134d28

Source: http://www.nirsoft.net/utils/lastactivityview.zip Hash MD5 - f94427f289819c831207cb83db695700

Command Line Option: /accepteula Artifact(s) Created: Key Path: HKEY_CURRENT_USER\Software\

Source(s): http://www.nirsoft.net/utils/cports.zip http://www.nirsoft.net/utils/cports-x64.zip 32 Bit

Source: https://winaudit.codeplex.com/ Hash MD5 - 92ade3b6212b1e6ec3ee3a140cbf80ac Hash Sha1 -

Source: https://github.com/jschicht/ExtractUsnJrnl/blob/master/ExtractUsnJrnl.exe https://github.com/

Source: http://malware-hunters.net/wp-content/downloads/MFTDump_V.1.3.0.zip Hash MD5 -

Source: https://github.com/jschicht/RawCopy/blob/master/RawCopy.exe https://github.com/jschicht/

Source: https://github.com/google/rekall/releases/download/v1.3.2/winpmem_2.0.1.exe Hash MD5 -

File Artifacts: Depending on the Action, AChoir may create file artifacts in acquisition directory.