Skill UI

This skill details the forensic analysis of Windows LNK shortcut files and Jump Lists. These artifacts record critical user activity, including file access and program execution, even after the original source files have been deleted. It covers using specialized tools (LECmd, JLECmd) and Python parsing techniques to reconstruct user timelines, making it essential for incident response and deep digital forensics examinations.

This tool correlates multiple system artifacts, including Windows registry keys (USBSTOR, MountedDevices), Event Logs, and SetupAPI logs, to reconstruct a detailed timeline of USB device usage. It determines first/last connection timestamps, tracks device provenance, and maps drive letter assignments. Essential for digital forensics investigations, insider threat detection, and verifying compliance regarding removable media usage.

This guide details a comprehensive workflow for digital forensic investigations focusing on Amcache.hve registry hive. It teaches how to use AmcacheParser to extract evidence of program execution, application installation, and driver loading, including correlating SHA-1 hashes with threat intelligence and reconstructing timelines. This is crucial for DFIR work to identify deleted executables and malicious activity.

This skill parses Windows Prefetch (.pf) files to reconstruct detailed application execution history. It is crucial for digital forensics, allowing analysts to track execution timelines, identify suspicious or renamed binaries, and investigate potential malware activity or lateral movement during incident response. It uses Python to extract run counts and accessed file details.

A comprehensive guide for collecting, parsing, and correlating system, application, and security logs from diverse sources (Windows, Linux, Web). This technique is crucial for reconstructing detailed event timelines, identifying initial access vectors, tracking lateral movement, and establishing evidence of unauthorized activity during post-breach forensic investigations.

This suite provides comprehensive utilities for digital forensic investigations, allowing users to analyze critical Windows artifacts. Tools like KAPE, MFTECmd, PECmd, and RECmd parse registry hives, $MFT records, prefetch files, and event logs. It is essential for building a robust timeline of program execution, file access patterns, and system persistence during DFIR incident response.

This guide details the process of parsing Windows LNK shortcut files to extract crucial forensic artifacts. It gathers information such as target paths, MAC timestamps, volume serial numbers, and machine identifiers. This technique is invaluable in digital forensics, helping investigators reconstruct user activity timelines, track accessed files on removable media, or build comprehensive evidence from compromised systems.

Hayabusa is a specialized threat-hunting and fast-forensics tool designed to analyze Windows EVTX event logs. It applies a comprehensive library of Sigma detection rules to raw log data, generating a single, prioritized, chronological timeline. The output includes severity levels, MITRE ATT&CK mappings, and detailed metrics, enabling analysts to perform rapid, SIEM-free incident triage and export results for collaborative analysis.

This guide details the process of parsing core Windows forensic artifacts, including MFT, Prefetch, Registry hives, ShellBags, and Amcache. Utilizing Eric Zimmerman's specialized EZ Tools, raw evidence is converted into standardized CSV/JSON formats. This process is crucial for Digital Forensics and Incident Response (DFIR) investigations, enabling analysts to reconstruct program execution, file access history, and persistence mechanisms, which can then be loaded into Timeline Explorer for unified analysis.

This tool provides forward-looking cost projection by calculating the average daily burn rate from a specified measurement window. It linearly extrapolates future spending across multiple time horizons (7d, 30d, 90d, 365d) and alerts users to the projected date of budget exhaustion. It is essential for proactive financial planning, SRE cost monitoring, and setting CI/CD build cost gates.