Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate RECmd_Kroll to RECmd_DFIRBatch #952

Merged
merged 1 commit into from
Jul 20, 2024
Merged

Migrate RECmd_Kroll to RECmd_DFIRBatch #952

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Modules/Compound/!EZParser.mkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Description: Eric Zimmerman Parsers
Category: Modules
Author: Phill Moore
Version: 1.4
Version: 1.5
Id: f531e7cc-c9f3-4d04-881b-dbc89d1e7f38
BinaryUrl: https://ericzimmerman.github.io/
ExportFormat: csv
Expand Down Expand Up @@ -43,7 +43,7 @@ Processors:
CommandLine: ""
ExportFormat: ""
-
Executable: RECmd_Kroll.mkape
Executable: RECmd_DFIRBatch.mkape
CommandLine: ""
ExportFormat: ""
-
Expand Down
4 changes: 2 additions & 2 deletions Modules/Compound/RECmd_AllBatchFiles.mkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
Description: 'RECmd: All RECmd Batch Output'
Category: Registry
Author: Andrew Rathbun
Version: 1.1
Version: 1.2
Id: f2c9c95d-375e-4fb7-b069-7e9b95ea6db5
BinaryUrl: https://f001.backblazeb2.com/file/EricZimmermanTools/RegistryExplorer_RECmd.zip
ExportFormat: csv
Expand All @@ -23,7 +23,7 @@ Processors:
CommandLine: ""
ExportFormat: ""
-
Executable: RECmd_Kroll.mkape
Executable: RECmd_DFIRBatch.mkape
CommandLine: ""
ExportFormat: ""
-
Expand Down
8 changes: 4 additions & 4 deletions Modules/EZTools/RECmd/RECmd_Kroll.mkape → Modules/EZTools/RECmd/RECmd_DFIRBatch.mkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
Description: 'RECmd: Kroll'
Description: 'RECmd: DFIR'
Category: Registry
Author: Andrew Rathbun
Version: 1.0
Version: 1.1
Id: 26e4a8f6-d745-4195-8b8e-563cf32a4952
BinaryUrl: https://f001.backblazeb2.com/file/EricZimmermanTools/RECmd.zip
ExportFormat: csv
Processors:
-
Executable: RECmd\RECmd.exe
CommandLine: -d %sourceDirectory% --bn BatchExamples\Kroll_Batch.reb --nl false --csv %destinationDirectory%
CommandLine: -d %sourceDirectory% --bn BatchExamples\DFIRBatch.reb --nl false --csv %destinationDirectory%
ExportFormat: csv

# Documentation
Expand All @@ -20,5 +20,5 @@ Processors:
# https://www.youtube.com/watch?v=tk9XsMHzPlM
# https://www.youtube.com/watch?v=GhCZfCzn2l0
# https://leanpub.com/eztoolsmanuals
# Uses the Kroll batch command file. This file should reside within KAPE\Module\bin\RECmd\BatchExamples.
# Uses the DFIR batch command file. This file should reside within KAPE\Module\bin\RECmd\BatchExamples.
# Note: --nl false replays transaction logs. If you don't want to replay transaction logs, change to --nl true.
Loading