在好例子网，分享、交流、成长！
您当前所在位置：首页 → Others 开发实例 → 一般编程问题 → 实时磁盘取证分析源码(PowerForensics)

实时磁盘取证分析源码(PowerForensics)

一般编程问题

下载此实例
  • 开发语言：Others
  • 实例大小：7.55M
  • 下载次数：0
  • 浏览次数：7
  • 发布时间：2024-05-08
  • 实例类别：一般编程问题
  • 发 布 人：chenxiaolan
  • 文件格式：.zip
  • 所需积分：2
 相关标签：
网友评论 举报投诉 收藏该页

实例介绍

【实例简介】

PowerForensics的目的是为硬盘取证分析提供一个全面的框架。

PowerForensics目前支持NTFS和FAT文件系统，并已开始支持扩展文件系统和HFS 。


【实例截图】
【核心代码】
文件清单
└── PowerForensics-359399756187450ba7da1b1ecab282d37d84ab9e
    ├── appveyor.yml
    ├── docs
    │   ├── favicon.ico
    │   ├── getinvolved.md
    │   ├── img
    │   │   ├── Find-Module.png
    │   │   ├── Gallery.png
    │   │   ├── GithubRelease.png
    │   │   ├── herokuapp.PNG
    │   │   ├── Import-Module1.png
    │   │   ├── Import-Module2.png
    │   │   ├── Install-Module.png
    │   │   ├── PowerForensicsLoadFlowChart.png
    │   │   └── unblock.png
    │   ├── index.md
    │   ├── LICENSE.md
    │   ├── modulehelp
    │   │   ├── Copy-ForensicFile.md
    │   │   ├── Get-ForensicAlternateDataStream.md
    │   │   ├── Get-ForensicAmcache.md
    │   │   ├── Get-ForensicAttrDef.md
    │   │   ├── Get-ForensicBitmap.md
    │   │   ├── Get-ForensicBootSector.md
    │   │   ├── Get-ForensicChildItem.md
    │   │   ├── Get-ForensicContent.md
    │   │   ├── Get-ForensicEventLog.md
    │   │   ├── Get-ForensicExplorerTypedPath.md
    │   │   ├── Get-ForensicFileRecordIndex.md
    │   │   ├── Get-ForensicFileRecord.md
    │   │   ├── Get-ForensicFileSlack.md
    │   │   ├── Get-ForensicGuidPartitionTable.md
    │   │   ├── Get-ForensicMasterBootRecord.md
    │   │   ├── Get-ForensicMftSlack.md
    │   │   ├── Get-ForensicNetworkList.md
    │   │   ├── Get-ForensicOfficeFileMru.md
    │   │   ├── Get-ForensicOfficeOutlookCatalog.md
    │   │   ├── Get-ForensicOfficeTrustRecord.md
    │   │   ├── Get-ForensicPartitionTable.md
    │   │   ├── Get-ForensicPrefetch.md
    │   │   ├── Get-ForensicRecentFileCache.md
    │   │   ├── Get-ForensicRegistryKey.md
    │   │   ├── Get-ForensicRegistryValue.md
    │   │   ├── Get-ForensicRunKey.md
    │   │   ├── Get-ForensicRunMru.md
    │   │   ├── Get-ForensicScheduledJob.md
    │   │   ├── Get-ForensicShellLink.md
    │   │   ├── Get-ForensicShimcache.md
    │   │   ├── Get-ForensicSid.md
    │   │   ├── Get-ForensicTimeline.md
    │   │   ├── Get-ForensicTimezone.md
    │   │   ├── Get-ForensicTypedUrl.md
    │   │   ├── Get-ForensicUnallocatedSpace.md
    │   │   ├── Get-ForensicUserAssist.md
    │   │   ├── Get-ForensicUsnJrnlInformation.md
    │   │   ├── Get-ForensicUsnJrnl.md
    │   │   ├── Get-ForensicVolumeBootRecord.md
    │   │   ├── Get-ForensicVolumeInformation.md
    │   │   ├── Get-ForensicVolumeName.md
    │   │   ├── Get-ForensicWindowsSearchHistory.md
    │   │   └── Invoke-ForensicDD.md
    │   ├── moduleinstall.md
    │   ├── moduleload.md
    │   └── publicapi
    │       ├── PowerForensics.BootSectors.GuidPartitionTableEntry.md
    │       ├── PowerForensics.BootSectors.GuidPartitionTableEntry.PARTITION_ATTRIBUTE.md
    │       ├── PowerForensics.BootSectors.GuidPartitionTable.md
    │       ├── PowerForensics.BootSectors.MasterBootRecord.md
    │       ├── PowerForensics.BootSectors.PartitionEntry.md
    │       ├── PowerForensics.FileSystems.Ext.BlockGroupDescriptor.FLAGS.md
    │       ├── PowerForensics.FileSystems.Ext.BlockGroupDescriptor.md
    │       ├── PowerForensics.FileSystems.Ext.Inode.FILE_MODE.md
    │       ├── PowerForensics.FileSystems.Ext.Inode.FLAGS.md
    │       ├── PowerForensics.FileSystems.Ext.Inode.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.CHECKSUM_TYPE.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.CREATOR_OS.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.DEFAULT_HASH_VERSION.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.DEFAULT_MOUNT_OPTIONS.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.ENCRYPTION_ALGORITHMS.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.ERRORS.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.FEATURE_COMPAT.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.FEATURE_INCOMPAT.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.FEATURE_RO_COMPAT.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.FLAGS.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.REVISION_LEVEL.md
    │       ├── PowerForensics.FileSystems.Ext.Superblock.STATE.md
    │       ├── PowerForensics.FileSystems.Fat.DirectoryEntry.FILE_ATTR.md
    │       ├── PowerForensics.FileSystems.Fat.DirectoryEntry.md
    │       ├── PowerForensics.FileSystems.Fat.FatVolumeBootRecord.md
    │       ├── PowerForensics.FileSystems.Fat.FileSystemInformation.md
    │       ├── PowerForensics.FileSystems.Fat.LongDirectoryEntry.md
    │       ├── PowerForensics.FileSystems.FileSystemEntry.md
    │       ├── PowerForensics.FileSystems.HFSPlus.AllocationFile.md
    │       ├── PowerForensics.FileSystems.HFSPlus.AttributesFile.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BSDInfo.ADMIN_FLAGS.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BSDInfo.FILE_MODE.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BSDInfo.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BSDInfo.OWNER_FLAGS.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.DataRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.DataRecord.RECORD_FLAGS.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.DataRecord.RECORD_TYPE.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.HeaderRecord.BTREE_ATTRIBUTE.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.HeaderRecord.BTREE_KEYCOMPARE.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.HeaderRecord.BTREE_TYPE.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.HeaderRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.KeyedRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.MapRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.NodeDescriptor.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.NodeDescriptor.NODE_KIND.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.Node.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.PointerRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.Record.md
    │       ├── PowerForensics.FileSystems.HFSPlus.BTree.UserDataRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.CatalogFile.md
    │       ├── PowerForensics.FileSystems.HFSPlus.CatalogFileRecord.FILE_FLAGS.md
    │       ├── PowerForensics.FileSystems.HFSPlus.CatalogFileRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.CatalogFile.TEXT_ENCODING.md
    │       ├── PowerForensics.FileSystems.HFSPlus.CatalogFolderRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.CatalogThread.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ExtendedFileInfo.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ExtendedFolderInfo.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ExtentDescriptor.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ExtentsOverflowFile.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ExtentsOverflowRecord.FORK_TYPE.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ExtentsOverflowRecord.md
    │       ├── PowerForensics.FileSystems.HFSPlus.FileInfo.md
    │       ├── PowerForensics.FileSystems.HFSPlus.FolderInfo.md
    │       ├── PowerForensics.FileSystems.HFSPlus.ForkData.md
    │       ├── PowerForensics.FileSystems.HFSPlus.Point.md
    │       ├── PowerForensics.FileSystems.HFSPlus.Rect.md
    │       ├── PowerForensics.FileSystems.HFSPlus.VolumeHeader.HFS_VERSION.md
    │       ├── PowerForensics.FileSystems.HFSPlus.VolumeHeader.md
    │       ├── PowerForensics.FileSystems.Ntfs.AttrDef.ATTR_DEF_ENTRY.md
    │       ├── PowerForensics.FileSystems.Ntfs.AttrDef.md
    │       ├── PowerForensics.FileSystems.Ntfs.ATTR_FILENAME_FLAG.md
    │       ├── PowerForensics.FileSystems.Ntfs.AttributeList.md
    │       ├── PowerForensics.FileSystems.Ntfs.AttrRef.md
    │       ├── PowerForensics.FileSystems.Ntfs.BadClus.md
    │       ├── PowerForensics.FileSystems.Ntfs.Bitmap.md
    │       ├── PowerForensics.FileSystems.Ntfs.Data.md
    │       ├── PowerForensics.FileSystems.Ntfs.DataRun.md
    │       ├── PowerForensics.FileSystems.Ntfs.EAInformation.md
    │       ├── PowerForensics.FileSystems.Ntfs.EA.md
    │       ├── PowerForensics.FileSystems.Ntfs.FileName.md
    │       ├── PowerForensics.FileSystems.Ntfs.FileRecordAttribute.ATTR_TYPE.md
    │       ├── PowerForensics.FileSystems.Ntfs.FileRecordAttribute.md
    │       ├── PowerForensics.FileSystems.Ntfs.FILE_RECORD_FLAG.md
    │       ├── PowerForensics.FileSystems.Ntfs.FileRecord.md
    │       ├── PowerForensics.FileSystems.Ntfs.IndexAllocation.md
    │       ├── PowerForensics.FileSystems.Ntfs.IndexAllocationTest.md
    │       ├── PowerForensics.FileSystems.Ntfs.IndexEntry.md
    │       ├── PowerForensics.FileSystems.Ntfs.INDEX_ROOT_FLAGS.md
    │       ├── PowerForensics.FileSystems.Ntfs.IndexRoot.md
    │       ├── PowerForensics.FileSystems.Ntfs.MasterFileTable.md
    │       ├── PowerForensics.FileSystems.Ntfs.NonResident.md
    │       ├── PowerForensics.FileSystems.Ntfs.NtfsVolumeBootRecord.md
    │       ├── PowerForensics.FileSystems.Ntfs.ObjectId.md
    │       ├── PowerForensics.FileSystems.Ntfs.StandardInformation.ATTR_STDINFO_PERMISSION.md
    │       ├── PowerForensics.FileSystems.Ntfs.StandardInformation.md
    │       ├── PowerForensics.FileSystems.Ntfs.UsnJrnlInformation.md
    │       ├── PowerForensics.FileSystems.Ntfs.UsnJrnl.md
    │       ├── PowerForensics.FileSystems.Ntfs.UsnJrnl.USN_REASON.md
    │       ├── PowerForensics.FileSystems.Ntfs.UsnJrnl.USN_SOURCE.md
    │       ├── PowerForensics.FileSystems.Ntfs.VolumeInformation.ATTR_VOLINFO.md
    │       ├── PowerForensics.FileSystems.Ntfs.VolumeInformation.md
    │       ├── PowerForensics.FileSystems.Ntfs.VolumeName.md
    │       ├── PowerForensics.FileSystems.VolumeBootRecord.md
    │       ├── PowerForensics.FileSystems.VolumeBootRecord.MEDIA_DESCRIPTOR.md
    │       ├── PowerForensics.Formats.ForensicTimeline.ACTIVITY_TYPE.md
    │       ├── PowerForensics.Formats.ForensicTimeline.md
    │       ├── PowerForensics.Formats.Gource.md
    │       ├── PowerForensics.Helper.FILE_SYSTEM_TYPE.md
    │       ├── PowerForensics.Helper.md
    │       ├── PowerForensics.Utilities.Compression.Xpress.md
    │       ├── PowerForensics.Utilities.DD.md
    │       ├── PowerForensics.Windows.Artifacts.AlternateDataStream.md
    │       ├── PowerForensics.Windows.Artifacts.ApacheAccessLog.md
    │       ├── PowerForensics.Windows.Artifacts.ApplicationCompatibilityCache.Amcache.md
    │       ├── PowerForensics.Windows.Artifacts.ApplicationCompatibilityCache.RecentFileCache.md
    │       ├── PowerForensics.Windows.Artifacts.ApplicationCompatibilityCache.Shimcache.md
    │       ├── PowerForensics.Windows.Artifacts.CommonNetworkRelativeLink.COMMON_NETWORK_RELATIVE_LINK_FLAGS.md
    │       ├── PowerForensics.Windows.Artifacts.CommonNetworkRelativeLink.md
    │       ├── PowerForensics.Windows.Artifacts.CommonNetworkRelativeLink.NETWORK_PROVIDER_TYPE.md
    │       ├── PowerForensics.Windows.Artifacts.ConsoleDataBlock.FILL.md
    │       ├── PowerForensics.Windows.Artifacts.ConsoleDataBlock.FONT.md
    │       ├── PowerForensics.Windows.Artifacts.ConsoleDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.ConsoleFeDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.DarwinDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.EnvironmentVariableDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.ExtraData.EXTRA_DATA_TYPE.md
    │       ├── PowerForensics.Windows.Artifacts.ExtraData.md
    │       ├── PowerForensics.Windows.Artifacts.IconEnvironmentDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.IdList.md
    │       ├── PowerForensics.Windows.Artifacts.ItemId.md
    │       ├── PowerForensics.Windows.Artifacts.JavaCache.md
    │       ├── PowerForensics.Windows.Artifacts.KnownFolderDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.MicrosoftOffice.FileMRU.md
    │       ├── PowerForensics.Windows.Artifacts.MicrosoftOffice.OutlookCatalog.md
    │       ├── PowerForensics.Windows.Artifacts.MicrosoftOffice.PlaceMRU.md
    │       ├── PowerForensics.Windows.Artifacts.MicrosoftOffice.TrustRecord.md
    │       ├── PowerForensics.Windows.Artifacts.Prefetch.md
    │       ├── PowerForensics.Windows.Artifacts.Prefetch.PREFETCH_ENABLED.md
    │       ├── PowerForensics.Windows.Artifacts.Prefetch.PREFETCH_VERSION.md
    │       ├── PowerForensics.Windows.Artifacts.PropertyStoreDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.RunKey.md
    │       ├── PowerForensics.Windows.Artifacts.SamHive.Sid.md
    │       ├── PowerForensics.Windows.Artifacts.SamHive.UserDetail.md
    │       ├── PowerForensics.Windows.Artifacts.ScheduledJob.md
    │       ├── PowerForensics.Windows.Artifacts.ScheduledJob.PRIORITY_CLASS.md
    │       ├── PowerForensics.Windows.Artifacts.ScheduledJob.PRODUCT_VERSION.md
    │       ├── PowerForensics.Windows.Artifacts.ScheduledJob.STATUS.md
    │       ├── PowerForensics.Windows.Artifacts.ScheduledJob.TASK_FLAG.md
    │       ├── PowerForensics.Windows.Artifacts.ScheduledTask.md
    │       ├── PowerForensics.Windows.Artifacts.ShellLink.FILEATTRIBUTE_FLAGS.md
    │       ├── PowerForensics.Windows.Artifacts.ShellLink.HOTKEY_FLAGS.md
    │       ├── PowerForensics.Windows.Artifacts.ShellLink.LINK_FLAGS.md
    │       ├── PowerForensics.Windows.Artifacts.ShellLink.LINKINFO_FLAGS.md
    │       ├── PowerForensics.Windows.Artifacts.ShellLink.md
    │       ├── PowerForensics.Windows.Artifacts.ShellLink.SHOWCOMMAND.md
    │       ├── PowerForensics.Windows.Artifacts.ShimDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.SoftwareHive.NetworkList.md
    │       ├── PowerForensics.Windows.Artifacts.SoftwareHive.WindowsVersion.md
    │       ├── PowerForensics.Windows.Artifacts.SpecialFolderDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.SystemHive.Timezone.md
    │       ├── PowerForensics.Windows.Artifacts.TrackerDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.LastVisitedMRU.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.RecentDocs.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.RunMRU.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.TypedPaths.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.TypedUrls.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.UserAssist.md
    │       ├── PowerForensics.Windows.Artifacts.UserHive.WordWheelQuery.md
    │       ├── PowerForensics.Windows.Artifacts.VistaAndAboveIDListDataBlock.md
    │       ├── PowerForensics.Windows.Artifacts.VolumeId.DRIVE_TYPE.md
    │       ├── PowerForensics.Windows.Artifacts.VolumeId.md
    │       ├── PowerForensics.Windows.EventLog.BinaryXml.md
    │       ├── PowerForensics.Windows.EventLog.BinaryXml.TOKEN_TYPE.md
    │       ├── PowerForensics.Windows.EventLog.BinaryXml.VALUE_TYPE.md
    │       ├── PowerForensics.Windows.EventLog.BinXmlAttributeList.md
    │       ├── PowerForensics.Windows.EventLog.BinXmlAttribute.md
    │       ├── PowerForensics.Windows.EventLog.BinXmlName.md
    │       ├── PowerForensics.Windows.EventLog.BinXmlValueText.md
    │       ├── PowerForensics.Windows.EventLog.EventRecord.md
    │       ├── PowerForensics.Windows.EventLog.FILEFLAGS.md
    │       ├── PowerForensics.Windows.Registry.Cell.md
    │       ├── PowerForensics.Windows.Registry.HashedLeaf.md
    │       ├── PowerForensics.Windows.Registry.LeafItem.md
    │       ├── PowerForensics.Windows.Registry.Leaf.md
    │       ├── PowerForensics.Windows.Registry.List.md
    │       ├── PowerForensics.Windows.Registry.NamedKey.md
    │       ├── PowerForensics.Windows.Registry.NamedKey.NAMED_KEY_FLAGS.md
    │       ├── PowerForensics.Windows.Registry.OffsetRecord.md
    │       ├── PowerForensics.Windows.Registry.ReferenceItem.md
    │       ├── PowerForensics.Windows.Registry.RegistryHeader.md
    │       ├── PowerForensics.Windows.Registry.RegistryHelper.md
    │       ├── PowerForensics.Windows.Registry.SecurityDescriptor.md
    │       ├── PowerForensics.Windows.Registry.SecurityDescriptor.SECURITY_KEY_CONTROLS.md
    │       ├── PowerForensics.Windows.Registry.SecurityKey.md
    │       ├── PowerForensics.Windows.Registry.ValueKey.md
    │       ├── PowerForensics.Windows.Registry.ValueKey.VALUE_KEY_DATA_TYPES.md
    │       └── PowerForensics.Windows.Registry.ValueKey.VALUE_KEY_FLAGS.md
    ├── Images
    │   ├── New_PowerForensics_Blue_small.png
    │   ├── powerforensic_icon.svg
    │   ├── powerforensics_nontransparent.svg
    │   ├── powerforensic_square_blue_lowres.png
    │   ├── powerforensic_square_blue.png
    │   ├── powerforensic_square_white_lowres.png
    │   ├── powerforensic_square_white.png
    │   ├── powerforensics_square_blue.svg
    │   ├── powerforensics_square_white.svg
    │   └── powerforensics.svg
    ├── lib
    │   ├── coreclr
    │   │   └── PowerForensics.dll
    │   └── PSv2
    │       └── PowerForensics.dll
    ├── LICENSE.md
    ├── mkdocs.yml
    ├── Modules
    │   └── PowerForensics
    │       ├── build.ps1
    │       ├── deploy.psdeploy.ps1
    │       ├── docs
    │       │   ├── Copy-ForensicFile.md
    │       │   ├── Get-ForensicAlternateDataStream.md
    │       │   ├── Get-ForensicAmcache.md
    │       │   ├── Get-ForensicAttrDef.md
    │       │   ├── Get-ForensicBitmap.md
    │       │   ├── Get-ForensicBootSector.md
    │       │   ├── Get-ForensicChildItem.md
    │       │   ├── Get-ForensicContent.md
    │       │   ├── Get-ForensicEventLog.md
    │       │   ├── Get-ForensicExplorerTypedPath.md
    │       │   ├── Get-ForensicFileRecordIndex.md
    │       │   ├── Get-ForensicFileRecord.md
    │       │   ├── Get-ForensicFileSlack.md
    │       │   ├── Get-ForensicGuidPartitionTable.md
    │       │   ├── Get-ForensicMasterBootRecord.md
    │       │   ├── Get-ForensicMftSlack.md
    │       │   ├── Get-ForensicNetworkList.md
    │       │   ├── Get-ForensicOfficeFileMru.md
    │       │   ├── Get-ForensicOfficeOutlookCatalog.md
    │       │   ├── Get-ForensicOfficeTrustRecord.md
    │       │   ├── Get-ForensicPartitionTable.md
    │       │   ├── Get-ForensicPrefetch.md
    │       │   ├── Get-ForensicRecentFileCache.md
    │       │   ├── Get-ForensicRegistryKey.md
    │       │   ├── Get-ForensicRegistryValue.md
    │       │   ├── Get-ForensicRunKey.md
    │       │   ├── Get-ForensicRunMru.md
    │       │   ├── Get-ForensicScheduledJob.md
    │       │   ├── Get-ForensicShellLink.md
    │       │   ├── Get-ForensicShimcache.md
    │       │   ├── Get-ForensicSid.md
    │       │   ├── Get-ForensicTimeline.md
    │       │   ├── Get-ForensicTimezone.md
    │       │   ├── Get-ForensicTypedUrl.md
    │       │   ├── Get-ForensicUnallocatedSpace.md
    │       │   ├── Get-ForensicUserAssist.md
    │       │   ├── Get-ForensicUsnJrnlInformation.md
    │       │   ├── Get-ForensicUsnJrnl.md
    │       │   ├── Get-ForensicVolumeBootRecord.md
    │       │   ├── Get-ForensicVolumeInformation.md
    │       │   ├── Get-ForensicVolumeName.md
    │       │   ├── Get-ForensicWindowsSearchHistory.md
    │       │   └── Invoke-ForensicDD.md
    │       ├── en-US
    │       │   └── PowerForensics.dll-Help.xml
    │       ├── lib
    │       │   ├── coreclr
    │       │   │   └── PowerForensics.dll
    │       │   └── PSv2
    │       │       └── PowerForensics.dll
    │       ├── PowerForensics.ps1xml
    │       ├── PowerForensics.psd1
    │       ├── PowerForensics.psm1
    │       ├── psake.ps1
    │       └── Tests
    │           └── PowerForensics.Test.ps1
    ├── PowerForensics.sln
    ├── README.md
    └── src
        ├── PowerForensics
        │   ├── PowerForensics.csproj
        │   └── Properties
        │       └── AssemblyInfo.cs
        └── PowerForensicsCore
            ├── build-PF.cmd
            ├── PowerForensicsCore.xproj
            ├── project.json
            ├── project.lock.json
            ├── Properties
            │   └── AssemblyInfo.cs
            └── src
                ├── Helper.cs
                ├── NativeMethods.cs
                ├── PowerForensics.BootSectors
                │   ├── GuidPartitionTable.cs
                │   └── MasterBootRecord.cs
                ├── PowerForensics.FileSystems
                │   ├── FileSystemEntry.cs
                │   └── VolumeBootRecord.cs
                ├── PowerForensics.FileSystems.ExFat
                │   └── ExFatVolumeBootRecord.cs
                ├── PowerForensics.FileSystems.Ext
                │   ├── BlockGroupDescriptors.cs
                │   ├── Inode.cs
                │   └── Superblock.cs
                ├── PowerForensics.FileSystems.Fat
                │   ├── DirectoryEntry.cs
                │   ├── FatVolumeBootRecord.cs
                │   ├── FileAllocationTable.cs
                │   └── FileSystemInformation.cs
                ├── PowerForensics.FileSystems.HFSPlus
                │   ├── AllocationFile.cs
                │   ├── AttributesFile.cs
                │   ├── BTree.cs
                │   ├── CatalogFile.cs
                │   ├── Extents.cs
                │   ├── ExtentsOverflowFile.cs
                │   └── VolumeHeader.cs
                ├── PowerForensics.FileSystems.Ntfs
                │   ├── AttrDef.cs
                │   ├── BadClus.cs
                │   ├── Bitmap.cs
                │   ├── FileRecordAttribute.cs
                │   ├── FileRecord.cs
                │   ├── IndexEntry.cs
                │   ├── MasterFileTable.cs
                │   ├── NtfsVolumeBootRecord.cs
                │   └── UsnJrnl.cs
                ├── PowerForensics.Formats
                │   ├── ForensicTimeline.cs
                │   └── Gource.cs
                ├── PowerForensics.Utilities
                │   ├── DD.cs
                │   └── Hash.cs
                ├── PowerForensics.Utilities.Compression
                │   └── Xpress.cs
                ├── PowerForensics.Windows.Artifacts
                │   ├── AlternateDataStream.cs
                │   ├── ApacheAccessLog.cs
                │   ├── JavaCache.cs
                │   ├── Prefetch.cs
                │   ├── RunKey.cs
                │   ├── ScheduledJob.cs
                │   ├── ScheduledTask.cs
                │   └── ShellLink.cs
                ├── PowerForensics.Windows.Artifacts.ApplicationCompatibilityCache
                │   ├── Amcache.cs
                │   ├── RecentFileCache.cs
                │   └── Shimcache.cs
                ├── PowerForensics.Windows.Artifacts.MicrosoftOffice
                │   ├── FileMRU.cs
                │   ├── OutlookCatalog.cs
                │   ├── PlaceMRU.cs
                │   └── TrustRecord.cs
                ├── PowerForensics.Windows.Artifacts.SamHive
                │   ├── Sid.cs
                │   └── UserDetails.cs
                ├── PowerForensics.Windows.Artifacts.SoftwareHive
                │   ├── NetworkList.cs
                │   └── WindowsVersion.cs
                ├── PowerForensics.Windows.Artifacts.SystemHive
                │   └── Timezone.cs
                ├── PowerForensics.Windows.Artifacts.UserHive
                │   ├── LastVisitedMRU.cs
                │   ├── RecentDocs.cs
                │   ├── RunMRU.cs
                │   ├── TypedPath.cs
                │   ├── TypedUrls.cs
                │   ├── UserAssist.cs
                │   └── WordWheelQuery.cs
                ├── PowerForensics.Windows.EventLog
                │   ├── BinaryXml.cs
                │   ├── EventRecord.cs
                │   ├── TextFile1.txt
                │   └── TextFile2.txt
                └── PowerForensics.Windows.Registry
                    ├── Cells
                    │   ├── Cell.cs
                    │   ├── NamedKey.cs
                    │   ├── SecurityDescriptor.cs
                    │   ├── SecurityKey.cs
                    │   └── ValueKey.cs
                    ├── List
                    │   ├── HashedLeaf.cs
                    │   ├── Leaf.cs
                    │   ├── LeafItem.cs
                    │   ├── List.cs
                    │   ├── OffsetRecord.cs
                    │   ├── ReferenceItem.cs
                    │   └── ValuesList.cs
                    ├── RegistryHeader.cs
                    └── RegistryHelper.cs

44 directories, 413 files

标签：

实例下载地址

实时磁盘取证分析源码(PowerForensics)

不能下载？内容有错？ 点击这里报错 + 投诉 + 提问

好例子网口号：伸出你的我的手 — 分享！

相关软件

相关文章

网友评论

我要评论

发表评论

(您的评论需要经过审核才能显示)

查看所有0条评论>>

小贴士

感谢您为本站写下的评论，您的评论对其它用户来说具有重要的参考价值，所以请认真填写。

  • 类似“顶”、“沙发”之类没有营养的文字，对勤劳贡献的楼主来说是令人沮丧的反馈信息。
  • 相信您也不想看到一排文字/表情墙，所以请不要反馈意义不大的重复字符，也请尽量不要纯表情的回复。
  • 提问之前请再仔细看一遍楼主的说明，或许是您遗漏了。
  • 请勿到处挖坑绊人、招贴广告。既占空间让人厌烦，又没人会搭理，于人于己都无利。

关于好例子网

本站旨在为广大IT学习爱好者提供一个非营利性互相学习交流分享平台。本站所有资源都可以被免费获取学习研究。本站资源来自网友分享，对搜索内容的合法性不具有预见性、识别性、控制性，仅供学习研究，请务必在下载后24小时内给予删除，不得用于其他任何用途，否则后果自负。基于互联网的特殊性，平台无法对用户传输的作品、信息、内容的权属或合法性、安全性、合规性、真实性、科学性、完整权、有效性等进行实质审查；无论平台是否已进行审查，用户均应自行承担因其传输的作品、信息、内容而可能或已经产生的侵权或权属纠纷等法律责任。本站所有资源不代表本站的观点或立场，基于网友分享，根据中国法律《信息网络传播权保护条例》第二十二与二十三条之规定，若资源存在侵权或相关问题请联系本站客服人员，点此联系我们。关于更多版权及免责申明参见 版权及免责申明

;
报警