Skip to content

Latest commit

 

History

History
33 lines (24 loc) · 1 KB

README.md

File metadata and controls

33 lines (24 loc) · 1 KB
Raw

Kirby Logo

kirby

A cute script to parse several forensic artifacts of given windows (triage) images, using dissect.

Usage

usage: kirby [-h] -o OUTPUT [--overwrite] TARGETS [TARGETS ...]

parse forensic artifacts from windows images, using dissect

positional arguments:
  TARGETS               Path to single target or directory with multiple targets to parse

options:
  -h, --help            show this help message and exit
  -o OUTPUT, --output OUTPUT
                        Specify the output directory
  --overwrite           overwrite destination directory

Output

  • hostinfo.csv - hostinfo of all targets parsed
  • Directory (named by the hostname of the image) including:
    • hostinfo_<hostname>.csv - with information of hostname, domain, windows version, install date, language, timezone, ips and users
    • other output of different dissect plugins