PS-Remote Acquire Host Forensics

This playbook allows the user to gather multiple forensic data from a Windows endpoint including network traffic, MFT (Master File Table), and registry export by using the PS Remote automation which enables connecting to a Windows host without the need to install any 3rd-party tools using just native Windows management tools.

Windows Forensics · 11 tasks · 4 inputs · 3 outputs

Inputs

  • GetNetworkTraffic — This input specifies whether to capture network traffic on the host.
  • GetMft — This input specifies whether to acquire the MFT for the host.
  • GetRegistry — This input specifies whether to export the registry on the host.
  • Host — A single hostname or IP address for which to export the registry file. For example, testpc01.

Outputs

  • PcapDetails — PCAP file details.
  • RegistryDetails — Registry file details.
  • MftDetails — MFT file details.

Flowchart

yes yes yes Start Start PS-Remote Get Registry - PS-Remote Get Registry PS-Remote Get Registry PS-Remote Get Registry Get network traffic? Get network traffic? Done Done Get MFT? Get MFT? Get registry? Get registry? PS-Remote Get Network Traffic - PS-Remote Get Network Traffic PS-Remote Get Network Tra... PS-Remote Get Network Traffic PS-Remote Get MFT - PS-Remote Get MFT PS-Remote Get MFT PS-Remote Get MFT Set PCAP details - SetAndHandleEmpty Set PCAP details SetAndHandleEmpty Set MFT details - SetAndHandleEmpty Set MFT details SetAndHandleEmpty Set registry file details - SetAndHandleEmpty Set registry file details SetAndHandleEmpty