IR
IR copied to clipboard
hiddenillusion
Some dfir stuff
Would be useful to have IP/Domain/Adapter info pulled from images in addition to hostname/product details in https://github.com/hiddenillusion/IR/blob/master/Disk_Analysis/get_system_details_from_image.py functions already written : https://github.com/williballenthin/python-registry/blob/master/samples/forensicating.py#L202
Other files to grab during Linux triage: - [ ] .viminfo - ssh - [ ] authorized_keys - [ ] .ssh/*
not sure it's needed for triaging but if you only have one shot I guess it could be useful: via Ian: for i in `echo $PATH | sed "s/:/ /g"`;...