ArtifactExtractor Logo

ArtifactExtractor

0
Free
Visit Website

ArtifactExtractor is a script that extracts common Windows artifacts from source images and VSCs. Artifacts in VSCs will be checked (via hash) if they are different from a later VSC/image copy before extraction. Dependencies: - None if using release executable on Windows. - Else: Install backports.lzma - Windows: Use latest wheel file available from [here] - Linux: Use a package manager, e.g. sudo apt install liblzma-dev - Install libewf libewf-legacy should be installed rather than libewf (experimental) - Newer experimental releases have a file corruption issue. - Windows: Use the MSI installer available from [here] - Linux: Use libewf-legacy build 20140806 (Windows ONLY) - Install pywin32: pip install pywin32 - Install remaining requirements: use requirements.txt - Use pip: pip install -r requirements.txt Usage: Create destination directory artifact_extractor.exe <source image> <dest dir> [-a <selected artifacts>] or artifact_extractor.exe -h for more options Credits: Joachim Metz and his libraries, John Corcoran for Unix Compatibility

FEATURES

ALTERNATIVES

A command-line tool for searching and extracting strings from files with various options like ASCII and Unicode string search.

A binary analysis platform for analyzing binary programs

Exterro is a data risk management platform that optimizes e-discovery, digital forensics, and cybersecurity compliance operations.

Comprehensive digital forensics and incident response platform for law enforcement, corporate, and academic institutions.

A comprehensive Linux log analysis tool that streamlines the investigation of security incidents by extracting and organizing critical details from supported log files.

Forensics tool for exploring offline Docker filesystems.

A comprehensive incident response tool for Windows computers, providing advanced memory forensics and access to locked systems.

Tool used for dumping memory from Android devices with root access requirement and forensic soundness considerations.

PINNED