PS-Remote Acquire Host Forensics

This playbook allows the user to gather multiple forensic data from a Windows endpoint including network traffic, MFT (Master File Table), and registry export by using the PS Remote automation which enables connecting to a Windows host without the need to install any 3rd-party tools using just native Windows management tools.

Pack

WindowsForensics

Tasks

11

Inputs

• GetNetworkTraffic — This input specifies whether to capture network traffic on the host.
• GetMft — This input specifies whether to acquire the MFT for the host.
• GetRegistry — This input specifies whether to export the registry on the host.
• Host — A single hostname or IP address for which to export the registry file. For example, testpc01.

Outputs

• PcapDetails — PCAP file details.
• RegistryDetails — Registry file details.
• MftDetails — MFT file details.