Example Usage
.\RetrievIR.ps1 : Default Usage - collects all artifacts specified in JSON within 'configs' directory from the localhost into the current directory. .\RetrievIR.ps1 -tags sans_triage - Capture most artifacts described in the SANS Triage package within KAPE .\RetrievIR.ps1 -targets HOSTNAME1,HOSTNAME2 : Run RetrievIR against the provided hostnames. .\RetrievIR.ps1 -target_file C:\targets.txt : Run RetrievIR against the line-delimited targets present in the specified text file. .\RetrievIR.ps1 -creds : Tell RetrievIR to prompt the user for credentials to use - by default, RetrievIR runs with the current user context. .\RetrievIR.ps1 -evidence_dir C:\evidence : Tell RetrievIR where to store collected evidence - by default, evidence will be stored in PSScriptRoot\evidence .\RetrievIR.ps1 -config C:\my_config.json : Specify the path to a custom configuration file to use - by default, RetrievIR will look for all JSON files within the 'configs' directory in PSScriptRoot (current executing directory). .\RetrievIR.ps1 -config C:\RetrievIRConfigs : Specify the path to a directory containing 1 or more customer configuration JSON to use - by default, RetrievIR will look for all JSON fil
See also
TRACE-Forensic-Toolkit
Open Source
Digital forensic analysis tool that provides a user-friendly interface for investigating disk images…
LockKnife
Open Source
LockKnife: The Ultimate Android Security Research Tool. A unified TUI workspace and headless CLI for…
SingleFileExtractor
Open Source
A tool for extracting contents (assemblies, configuration, etc.) from a single-file application to a…
aparoid
Free
Static and dynamic Android application security analysis…
apiosintDS
Open Source
On demand query API for https://github.com/davidonzo/Threat-Intel project.…
volatility3
Free
Volatility is the world's most widely used framework for extracting digital artifacts from volatile …