DFIR Toolkit

Table of contents

• Installation
• Overview of timelining tools
• Tools
  • [x] [cleanhive](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/cleanhive.md)
  • [x] [evtx2bodyfile](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/evtx2bodyfile.md)
  • [x] [evtxanalyze](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/avtxanalyze.md)
  • [x] [evtxscan](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/evtxscan.md)
  • [x] [evtxcat](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/evtxcat.md)
  • [x] [evtxls](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/evtxls.md)
  • [x] [es4forensics](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/es4forensics.md)
  • [x] [hivescan](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/hivescan.md)
  • [x] [ipgrep](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/ipgrep.md)
  • [ ] [lnk2bodyfile](https://github.com/janstarke/lnk2bodyfile)
  • [x] [mactime2](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/mactime2.md)
  • [ ] [mft2bodyfile](https://github.com/janstarke/mft2bodyfile)
  • [ ] [ntdsextract2](https://github.com/janstarke/ntdsextract2)
  • [x] [pol_export](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/pol_export.md)
  • [ ] [procbins](https://github.com/janstarke/procbins)
  • [x] [regdump](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/regdump.md)
  • [ ] [regls](https://github.com/janstarke/regls)
  • [ ] [regview](https://github.com/janstarke/regview)
  • [x] [ts2date](https://github.com/dfir-dd/dfir-toolkit/blob/main/doc/ts2date.md)
  • [ ] [usnjrnl_dump](https://github.com/janstarke/usnjrnl)

Overview of timelining tools

Installation

bash cargo install dfir-toolkit

To generate autocompletion scripts for your shell, invoke the tool with the --autocomplete option, e.g.

bash mactime2 --autocomplete bash | sudo tee /etc/bash_completion.d/mactime2

would install a autocompletion script in /etc/bash_completion.d/mactime2.