forensicanalysis / artifacts

📇 Digital Forensics Artifact Repository (forensicanalysis edition)

Digital Forensics Artifact Repository (forensicanalysis edition)

The repository is a fork of ForensicArtifacts/artifacts: More information

A free, community-sourced, machine-readable knowledge base of digital forensic artifacts that the world can use both as an information source and within other tools.

If you'd like to use the artifacts in your own tools, all you need to be able to do is read YAML. That is it, no other dependencies. The Python code in this project is just used to validate all the artifacts to make sure they follow the specification.

Artifact Definitions

The artifact definition format is described in detail in the Style Guide.

As of 2022-04-24 the repository contains:

Artifact definition by type

ARTIFACT GROUP	COMMAND	DIRECTORY	FILE	PATH	REGISTRY KEY	REGISTRY VALUE	WMI
37	9	15	367	26	69	126	27

Artifact definition by OS

DARWIN	LINUX	WINDOWS
151	152	365

Background/History

The repository is a fork of https://github.com/ForensicArtifacts/artifacts with the following changes:

• conditions are ignored as they have some issues (#274)
• provides on the artifact definition are deprecated, as they do not enable extraction of parameters without further parsing information
• provides on source level are added to enable extraction of parameters
• All source types are distinctly defined, including the DIRECTORY type (#286).
• Parameter expansion and globing is defined, including ** (#342).
• Inconsistent trailing \* in REGISTRY_KEYs are removed (#255).
• Validate path separators (#265).
• More validations, smaller documentation fixes (#23), ...

See Updated Style Guide

The ForensicArtifacts.com artifact repository was forked from the GRR project artifact collection into a stand-alone repository that is not tool-specific. The GRR developers have migrated to using this repository and make contributions here. In addition the ForensicArtifact team will begin backfilling artifacts in the new format from the ForensicArtifacts.com website.

For some background on the artifacts system and how we expect it to be used see this blackhat presentation and youtube video from the GRR team.

Contributing

Please send us your contribution!

Contact

• Artifacts channel of Open Source DFIR Slack

artifacts's Issues

Add current control sets

Define and use control sets in other artifacts.

Idea:

name: WindowsRegistryCurrentControlSets
doc: The control sets of the Windows Registry.
sources:
- type: REGISTRY_KEY
  attributes:
    keys: 
      - 'HKEY_LOCAL_MACHINE\System\ControlSet*'
      - 'HKEY_LOCAL_MACHINE\System\CurrentControlSet'
  provides:
    - key: control_sets
supported_os: [Windows]

Remove legacy.yaml

Dependency Dashboard

This issue provides visibility into Renovate updates and their statuses. Learn more

This repository currently has no open or pending branches.

---

• Check this box to trigger a request for Renovate to run again on this repository

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: undefined. Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.

Add gpresult artifact definition

gpresult.exe lists applied Windows Group Policies

gpresult.exe /SCOPE Computer /X out.xml