4. Windows PowerShell
New generation command – line interface
Users are able to link several commands
PS C:> Get-ChildItem C: | Get-ForensicFileRecord
6. Windows PowerShell Functions
Similary with programming languages
Saving time when tackling repetitive tasks
function Stop-Script () {
"Script terminating..."
Write-Output "========================================================"
Exit }
9. PowerForensics Cmdlets
Boot Sector:
Get-ForensicMasterBootRecord - gets the MasterBootRecord from the
first sector of the hard drive
Get-ForensicGuidPartitionTable - gets the GuidPartitionTable from the
first sector of the hard drive
Get-ForensicPartitionTable - gets the partition table for the specified
drive
10. PowerForensics Cmdlets
Windows Registry
Get-ForensicRegistryKey - gets the keys of the specified registry hive
Get-ForensicRegistryValue - gets the values of the specified registry key
11. PowerForensics Cmdlets
Get-ForensicFileRecord - gets Master FileTable entries (parses $MFT)
Get-ForensicVolumeBootRecord - gets theVolumeBootRecord from the
first sector of the volume (parses $Boot)
Invoke-ForensicDD - provides a bit for bit copy of a specified device
Copy-ForensicFile - creates a copy of a file from its raw bytes on disk