ForensicMiner: PowerShell-based DFIR automation tool

ForensicMiner

ForensicMiner, a PowerShell-based DFIR automation tool, revolutionizes the field of digital investigations. Designed for efficiency, it automates artifact and evidence collection from Windows machines. Compatibility with Flacon Crowdstrike RTR and Palo Alto Cortex XDR Live Terminal, along with its swift performance and user-friendly interface, makes ForensicMiner an indispensable asset for investigators navigating the complexities of forensic analysis. Streamlined and effective, this tool sets a new standard in the realm of digital forensics.

Install

Know This Before Installation

• Always install ForensicMiner on “C:” drive.
• Always run ForensicMiner as administrator, if not, some things may not work properly.
• Don’t run the tool using Windows PowerShell (x86)! if you do, some things may not work properly.
• Make sure your PowerShell Execution Policy is on Bypass, if not, scripts could not run on your system.
  • For more information use this PS Execution Policy Guide – https://www.youtube.com/watch?v=L0fgZ0FJIv0

Installation Process – Text Guide

1. In this GitHub repository, click on “<> Code,” and then select “Download ZIP.”
2. Extract the “ForensicMiner” folder from “ForensicMiner-main.zip”.
3. Move the “ForensicMiner” folder to C:\ drive.
4. That’s it! ForensicMiner is now installed. Enjoy

Tutorial

Copyright (c) 2023 Eilay Yosfan (DFIR)