meta data for this page
  •  

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
soc:irt:playbooks:windows_disk [2026/06/16 13:15] – titannetsoc:irt:playbooks:windows_disk [2026/06/16 14:45] (current) – titannet
Line 18: Line 18:
 ==== Env variables ==== ==== Env variables ====
 <code bash> <code bash>
 +rm ~/.case.env
 pwd pwd
-WD=/case/working/folder && echo 'WD=$WD' >> ~/.case.env +WD=/case/working/folder && echo "WD=$WD" >> ~/.case.env 
-E=/case/working/folder/evidence/evidence.E01 && echo 'E=$E' >> ~/.case.env+E=/case/working/folder/evidence/evidence.E01 && echo "E=$E" >> ~/.case.env 
 </code> </code>
  
Line 31: Line 33:
 # -p has 'pretty' & predictable folder name, fails if in use # -p has 'pretty' & predictable folder name, fails if in use
 # new tab or crtl-z # new tab or crtl-z
-DISK_C=<imount_dir> & echo 'DISK_C=$DISK_C' >> ~/.case.env+DISK_C=<imount_dir> && echo "DISK_C=$DISK_C" >> ~/.case.env
 </code> </code>
  
Line 45: Line 47:
 # two step # two step
 log2timeline.py --storage-file /work/data/timeline.plaso /work/evidence/<filename> log2timeline.py --storage-file /work/data/timeline.plaso /work/evidence/<filename>
-psort.py -o dynamic,json_line -w /work/output/plaso_out.json /work/data/timeline.plaso+psort.py -o json_line -w /work/output/plaso_out.json /work/data/timeline.plaso
 #psort.py -o json_line -w /work/output/plaso_out.json /work/data/timeline.plaso #psort.py -o json_line -w /work/output/plaso_out.json /work/data/timeline.plaso
  
 +
 +cp output/plaso_out.json tools/splunk/import/
 +cd tools/splunk
 +docker compose up -d
 +# -> localhost:8000, admin:password, settings->add->monitor->files->index_once->source_type=plaso
  
 </code> </code>
Line 66: Line 73:
 # dissect # dissect
  
-target-query -f hostname,domain,version,ips,install_date,timezone "$E" +target-query -f hostname,domain,version,ips,install_date,timezone $E 
-target-query -j -f services "$E" | jq -r '.name' +# much more useful for queries on multiple disks at once 
 + 
 +target-query -j -f services $E | jq -r '.name' 
 # JSON output → jq # JSON output → jq
 target-query --list | grep -iE 'userassist|shimcache|amcache|services|powershell_history|browser.history' target-query --list | grep -iE 'userassist|shimcache|amcache|services|powershell_history|browser.history'
 </code> </code>