PSRecon Logo

PSRecon

0
Free
Visit Website

PSRecon is a PowerShell-based incident response and live forensic data acquisition tool that gathers data from a remote Windows host, organizes the data into folders, hashes all extracted data, and sends the data to the security team. It also includes endpoint lockdown functionality, allowing users to disable an active directory account or quarantine the host until IT/Security can respond. The tool provides a detailed report that is self-contained, making it easy to share. It can be integrated with the organization's Active Defense frameworks to automate rapid forensic data acquisition and lock down the endpoint. PSRecon can be run on local or remote hosts, and offers various options for enabling PSRemoting and Unrestricted PowerShell Execution.

FEATURES

ALTERNATIVES

Automated collection tool for incident response triage in Windows systems.

NBD is a userland implementation of the Network Block Device protocol, allowing for remote access to block devices over a network.

Dissect is a digital forensics & incident response framework that simplifies the analysis of forensic artefacts from various disk and file formats.

A high-performance digital forensics exploitation tool for extracting structured information from various inputs without parsing file system structures.

A command-line utility for extracting human-readable text from binary files.

An extensible network forensic analysis framework with deep packet analysis and plugin support.

A reconnaissance tool for GitHub organizations

Python forensic tool for extracting and analyzing information from Firefox, Iceweasel, and Seamonkey browsers.

PINNED