So in summary, the goal for this module was to utilize PowerForensics.
And to do that, we first reviewed a little bit about disk forensics.
And if remember,
our primary goal is to make a disk clone, or a clone of whatever the media is
that we wish to utilize. We then went through and installed,
imported the PowerShell forensics module, and then we executed some of
the base commands just to check that it would work.
We then ran core PowerForensics commands and we extracted
information. We looked for deleted files.
And then lastly, we created a forensic timeline.
Now, when all of these are tied together, from the beginning
where we started with a triage script to be able to retrieve
information about the device, the target,
the machine that we're working on, all the way through to generating
the HTML file to export in the log files and then combine it with
hard disk analysis, that truly brings together that art of live
response and obviously triage information together. Using both of
these capabilities together will help you then to understand what
happens, for example,
if a machine is compromised, and be able to draw a conclusion to say,
well, actually what happened is this happened on the machine,
the end user interacted here,
something happened with this executable or this application
or this file, and then spawned off a series of activities
which then compromised the machine.