Example Usage
.\RetrievIR.ps1 : Default Usage - collects all artifacts specified in JSON within 'configs' directory from the localhost into the current directory. .\RetrievIR.ps1 -tags sans_triage - Capture most artifacts described in the SANS Triage package within KAPE .\RetrievIR.ps1 -targets HOSTNAME1,HOSTNAME2 : Run RetrievIR against the provided hostnames. .\RetrievIR.ps1 -target_file C:\targets.txt : Run RetrievIR against the line-delimited targets present in the specified text file. .\RetrievIR.ps1 -creds : Tell RetrievIR to prompt the user for credentials to use - by default, RetrievIR runs with the current user context. .\RetrievIR.ps1 -evidence_dir C:\evidence : Tell RetrievIR where to store collected evidence - by default, evidence will be stored in PSScriptRoot\evidence .\RetrievIR.ps1 -config C:\my_config.json : Specify the path to a custom configuration file to use - by default, RetrievIR will look for all JSON files within the 'configs' directory in PSScriptRoot (current executing directory). .\RetrievIR.ps1 -config C:\RetrievIRConfigs : Specify the path to a directory containing 1 or more customer configuration JSON to use - by default, RetrievIR will look for all JSON fil
See also
horus
Open Source
An OSINT / digital forensics tool built in Python…
NetworkMiner
Freemium
Network forensics analysis tool (NFAT) that captures packets and parses them to reconstruct transmit…
APKiD
Free
Android Application Identifier for Packers, Protectors, Obfuscators and Oddities - PEiD for Android…
htmldate
Open Source
Fast and robust date extraction from web pages, with Python or on the command-line…
digler
Open Source
Digler is a tool for forensic disk analysis and file recovery. It's designed to help you unearth los…
Ultimate-RAT-Collection
Free
For educational purposes only, exhaustive samples of 500+ classic/modern trojan builders including s…