DFIR Reference v0.1

Windows Registry Forensic Artifacts

RegRipper 3.0/4.0 · Sysinternals Autoruns v14.11 · RECmd · SBECmd · AmcacheParser · HoboCopy · FTK Imager · Hexacorn BGORK · LOLRMM.io (23 RMM tools) · Notable Attacker Tools · Portable Tools (No Registry) · MITRE ATT&CK v18/v19 (68 techniques mapped)

587Artifacts
20Categories
8Hive Types
20Tool Sources
RR 3.0 RR 4.0 Autoruns SBECmd AmcacheParser RECmd
Showing 587 of 587 artifacts
Copied!