elementary
elementary copied to clipboard
forensicanalysis
🕵️ Process and show forensic artifacts (e.g. eventlogs, usb devices, network devices...) in forensicstores
elementary
The elementary tool can process forensicstores created with the artifactcollector.
💾 Installation
Elementary is available as a single binary that does not require installation. It can be used e.g. from a usb stick this way. However different installation options are available to make setup and updating of elementary easier.
homebrew (macOS and Linux)
If you have the Homebrew package manager installed, you can install elementary using:
brew tap forensicanalysis/tap
brew install elementary
scoop (Windows)
If you have the Scoop package manager installed, you can install elementary using:
scoop bucket add elementary https://github.com/forensicanalysis/homebrew-tap
scoop install elementary
deb/rpm (Linux)
Download the .deb or .rpm from the releases
page and install with dpkg -i and rpm -i respectively.
manually
The GitHub releases pages provides binaries for all common systems.
🧑💻 Usage
For all commands see elementary --help. For all features and flags append --help to any command.
Unpack a forensicstore
elementary archive unpack pc2dd9f0f_2020-05-16T16-46-25.forensicstore
Get connected usb devices
elementary run usb pc2dd9f0f_2020-05-16T16-46-25.forensicstore
Get some autostarts
elementary run run-keys pc2dd9f0f_2020-05-16T16-46-25.forensicstore
List installed services
elementary run services pc2dd9f0f_2020-05-16T16-46-25.forensicstore
List uninstall entries
elementary run software pc2dd9f0f_2020-05-16T16-46-25.forensicstore
List network devices
elementary run networking pc2dd9f0f_2020-05-16T16-46-25.forensicstore
🚫 Limitations
- Most commands only process Windows artifacts
- Prefetch file processing is very slow
💬 Contact
For feedback, questions and discussions you can use the Discussions or the Open Source DFIR Slack.
Metadata
Owner
forensicanalysis
Metadata
🕵️ Process and show forensic artifacts (e.g. eventlogs, usb devices, network devices...) in forensicstores