ForensicArtifacts/artifacts

Issues

• Move application definitions into individual definition files

  #459 opened 10 months ago by binglot
  5

• Look into overlap MacOSSystemConfigurationPreferencesPlistFile and MacOSSystemPreferencesPlistFile

  #614 opened 10 months ago by joachimmetz
  0

• Deprecate provides

  #275 opened a year ago by joachimmetz
  3

• Consider adding %%system_all_volumes%%

  #609 opened a year ago by joachimmetz
  0

• Split WindowsCortanaDatabase

  #601 opened a year ago by joachimmetz
  0

• Add Chrome "Web Data" artifact

  #424 opened a year ago by obsidianforensics
  2

• Add Chrome "Login Data" artifact

  #423 opened a year ago by obsidianforensics
  2

• Changes for deployment

  #594 opened a year ago by joachimmetz
  0

• Add VNC password artifact

  #587 opened a year ago by goldenkirbi
  0

• Troubleshooting

  #583 opened a year ago by TNViking
  0

• Change definitions to use allusersappdata to programdata

  #339 opened 6 years ago by joachimmetz
  1

• Generate stats in README.md on release

  #345 opened a year ago by joachimmetz
  1

• Add definition for Firefox Cookies

  #561 opened 2 years ago by chb2mn
  4

• Add Mac Analytics Data logs

  #548 opened 2 years ago by hed-g
  0

• Fix forensic wiki URLs for mac_os_x_10.9_artifacts_location

  #549 opened 2 years ago by hed-g
  0

• Remove (deprecated) labels

  #463 opened 2 years ago by joachimmetz
  1

• Where can I find artifacts-kb?

  #502 opened 3 years ago by m0untain33r
  2

• Spec Proposal: Authors field

  #494 opened 3 years ago by cugu
  5

• Change legacy definitions to use alias

  #465 opened 3 years ago by joachimmetz
  0

• Determine how MacOS and other "Directory" artifact definitions are intended to be used

  #285 opened 3 years ago by tomchop
  3

• Consider moving labels to configuration file

  #284 opened 3 years ago by joachimmetz
  1

• Look at unifying PATH and DIRECTORY artifact definitions types

  #286 opened 3 years ago by joachimmetz
  1

• Add support for aliases

  #456 opened 3 years ago by joachimmetz
  1

• Move ChromeHistory to legacy

  #455 opened 3 years ago by joachimmetz
  0

• Add NTFS USN change journal artifact

  #448 opened 3 years ago by m1435
  8

• Pulling $Secure:$SDS and $Extend\$UsnJrnl:$J Files

  #431 opened 3 years ago by gremlin205
  1

• update release script to generate docs/sources/background/Stats.md

  #418 opened 4 years ago by joachimmetz
  0

• WindowsRegistryProfile requires grr

  #407 opened 4 years ago by the-exodus
  6

• Add outlook extension Windows Registry keys

  #410 opened 4 years ago by joachimmetz
  0

• Consider how CurrentControlSet and ControlSet### are defined

  #401 opened 4 years ago by joachimmetz
  8

• Add artifacts for Powershell command history and logs

  #399 opened 4 years ago by sa3eed3ed
  0

• Edit current collections for amcache and usrclass

  #397 opened 4 years ago by JorahTheExplorer
  3

• Adding FeatureUsage for Windows 10 Taskbar Forensics

  #390 opened 5 years ago by Karneades
  1

• Add definition for Apple TCC MDM overrides

  #394 opened 5 years ago by joachimmetz
  0

• Extend WindowsActivitiesCache definition

  #376 opened 5 years ago by joachimmetz
  1

• MacOSFSEvents paths should be an array

  #364 opened 5 years ago by cugu
  2

• Consider adding artifacts from PowerShell Empire

  #360 opened 5 years ago by rgayon
  1

• Consider updating/adding some artifacts from DFIR-ORC

  #359 opened 5 years ago by rgayon
  1

• WindowsSystemRegistryFiles add SysWOW64 paths

  #355 opened 6 years ago by joachimmetz
  0

• Check if LocalServer32 definition should be a value

  #348 opened 6 years ago by joachimmetz
  0

• Define behavior of globstar (**)

  #342 opened 6 years ago by joachimmetz
  2

• Check WindowsUninstallKeys

  #329 opened 6 years ago by joachimmetz
  1

• Validate users variables that are not the first path segment

  #310 opened 6 years ago by joachimmetz
  1

• Validate environment variables

  #311 opened 6 years ago by joachimmetz
  3

• Remove last returned_types

  #316 opened 6 years ago by cugu
  4

• validator: add changes to check if urls is a list

  #318 opened 6 years ago by joachimmetz
  0

• Add validator check for Mac OS private paths

  #309 opened 6 years ago by joachimmetz
  0

• Clean up WindowsEnvironmentVariableAllUsersProfile

  #297 opened 6 years ago by joachimmetz
  0

• Consider Adding Windows Backstage Artifacts

  #296 opened 6 years ago by broberson344
  0

• Consider adding a FindSpec artifact definition

  #283 opened 6 years ago by joachimmetz
  2