| # Written By: Andrew Case / andrew [ @ ] memoryanalysis.net | |
| # Script based off file structure documented at: | |
| # http://www.forensicfocus.com/downloads/forensic-analysis-vista-recycle-bin.pdf | |
| # prints CSV list of file size, delete time in local time, and full path on disk of deleted file | |
| import sys, struct, datetime, os | |
| def parse_i_file(i_file_path): | |
| try: |
The purpose of this document is to make recommendations on how to browse in a privacy and security conscious manner. This information is compiled from a number of sources, which are referenced throughout the document, as well as my own experiences with the described technologies.
I welcome contributions and comments on the information contained. Please see the How to Contribute section for information on contributing your own knowledge.
| rule GenericPowershell | |
| { | |
| strings: | |
| $a = "PS>function" | |
| $b = "Invoke-Expression" | |
| $c = "<MS><S N=" | |
| $d = "</MS></Obj>" | |
| $e = "CompileAssemblyFromSource" | |
| $f = "Remoting.RemoteHostMethodId" | |
| $g = "<resp:Arguments" |