Forensics Tools Analysis

This playbook allows the user to analyze forensic evidence acquired from a host, such as registry files and PCAP files.

Windows Forensics · 8 tasks · 2 inputs · 0 outputs

Inputs

  • PcapEntryID — The entryid for the PCAP file to analyze.
  • RegistryEntryId — The entryid for the registry file to analyze.

Flowchart

yes yes Start Start Registry Parse Data Analysis - Registry Parse Data Analysis Registry Parse Data Analysis Registry Parse Data Analysis Done Done Is there a PCAP file to analyze? Is there a PCAP file to a... Is there a registry file to analyze? Is there a registry file ... PCAP Search - PCAP Search PCAP Search PCAP Search PCAP Analysis PCAP Analysis Registry Analysis Registry Analysis