-
Notifications
You must be signed in to change notification settings - Fork 29
ForensicCopy
Matthew Green edited this page Feb 9, 2019
·
1 revision
- Reflectively loads Powerforensics onto target machine to enable raw disk access.
- Leverages a scriptblock for each configured function of the script.
- Common forensic artefacts and custom file collections.
- WinPMem for memory support
- Depending on the selected switches, each selected capability is joined at run time to build the scriptblock relevant to usecase.