mnerv/artif
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
14 Commits 1 Branch 0 Tags
trunk
Commit Graph

11 Commits

Author SHA1 Message Date
mnerv
687ac88c85 winfetch: improve GPU detection and add logo variants 
- Prioritize discrete GPU (NVIDIA/AMD) over integrated graphics
- Add classic Windows 7/Vista logo
- Add Windows 8/10 logo
- Add Windows 95 retro logo
- Add Windows 2025 logo with rounded corners
- Fix classic logo alignment with padding
 2026-02-04 00:03:20 +01:00
mnerv
0307f2b4eb Fetch correct GPU info 2026-02-03 23:54:43 +01:00
mnerv
a788ee5151 Add clear options to Get-HotspotConnections.ps1 
- Add -Clear flag to clear all hotspot artifacts (event logs + ARP cache)
- Add -ClearHotspot flag to clear WLAN-AutoConfig event logs only
- Add -ClearArp flag to clear ARP cache only
- Display additional manual clear commands with warnings for broader-impact logs
 2026-02-03 23:38:28 +01:00
mnerv
ed0c1983b3 Add startup and persistence analysis tools 
Add Get-AutoRun.ps1, Get-ScheduledTasks.ps1, and Get-Services.ps1
for analyzing auto-start programs and persistence mechanisms.

Get-AutoRun: Run/RunOnce keys, Startup folders, startup tasks
Get-ScheduledTasks: Detailed task analysis with filters
Get-Services: Service enumeration using WMI/CIM

Uses Get-CimInstance for reliable service enumeration, avoiding
Get-Service permission issues. Multiple filters and output modes.

Update TODO.md.
 2026-02-03 22:39:35 +01:00
mnerv
ce250b9725 feat: Add search history extraction (Get-SearchHistory.ps1) 
Extract Windows Search queries, typed paths, and Run dialog history
from registry (WordWheelQuery, TypedPaths, RunMRU).

Includes warnings about Windows 11 limitations - modern search without
Microsoft account doesn't persist history due to cloud-first design.

Update TODO.md.
 2026-02-03 22:32:43 +01:00
mnerv
aa4e6fa88f Add typed URLs extraction with multi-profile support 
Add Get-TypedURLs.ps1 for browser typed URL forensics:
- IE (registry), Edge, Chrome, Chromium (all profiles), Firefox
- Auto-detects all browser profiles (Default, Profile 1, 2, etc.)
- Shows typed counts and visit frequencies
- Proper DB locking/cleanup with finally blocks
- Requires sqlite3.exe for Chromium-based browsers

Update README.md and TODO.md with recent scripts.
 2026-02-03 22:25:56 +01:00
mnerv
d41fa4d4bd winfetch: add more color display 2026-02-03 22:10:45 +01:00
mnerv
01481b3e94 Add winfetch for Windows system info display 
Add fastfetch-inspired system information tool with Windows 11
ASCII logo. Shows user, OS, hardware, memory, disk, uptime with
pretty ANSI colors. Supports -Logo small for compact output.

Uses dynamic padding for proper alignment and WMI/CIM for
hardware detection.
 2026-02-03 22:08:33 +01:00
mnerv
0f15779472 Add Jump Lists collection (Get-JumpLists.ps1) 
Collect Jump List artifacts showing recent files per application.
Includes smart app detection via content scanning, LNK file
enumeration with target extraction, and both automatic/custom
destinations. Supports -ShowAll and -MaxPerApp parameters.

Mark Jump Lists complete in TODO.md.
 2026-02-03 21:57:10 +01:00
mnerv
dcebc0f4fa Add SSH artifacts collection (Get-SSHArtifacts.ps1) 
Collect SSH forensic data: known hosts with counts, SSH config,
keys, authorized_keys, PuTTY sessions, and server logs.

Update TODO.md with completed scripts.
 2026-02-03 21:48:51 +01:00
mnerv
878d19f917 Add Windows forensic artifact collection toolkit 
Add PowerShell scripts for collecting forensic artifacts:
- USB/storage devices, mounted drives, portable devices
- Network history and hotspot connections
- Recent documents (OpenSavePidlMRU with PIDL parsing)
- System info and user enumeration with multiple output modes

Includes TODO.md for planned artifacts and updated README.
 2026-02-03 21:31:39 +01:00