gs3cl / dfirt

Collect information of Windows PC when doing incident response

🔳 DFIRT (DFIR Tool)

Collect information of Windows PC when doing incident response.

ℹ️ DFIRT is a Powershell script. It collects information of-

• recently used files,
• suspicious Event ID,
• Powershell history for all session,
• files opened directly from Windows Explorer,
• network related running services,
• free space of disk,
• Internet connectivity information,
• safe DLL search mode,
• last boot up time,
• user accounts list from SID,
• computer name, current build, ID,
• current user language settings,
• Windows Defender Status,
• current Admin Approval Mode policy,
• domain,
• non default folders in Program File.

🔰 How to use:

1. Download the dfirt.ps1 script.
2. Start Windows Powershell.
3. Go to the DFIR folder.
4. Write .\dfirt.ps1 and press Enter.
5. Now, DFIRT will start collecting information and save those information in report.txt file.

⚠️ Remember

When you will run the script, result will be saved in report.txt file. But, if you again run the script and there is still previously saved report.txt file in the DFIRT folder then, the file will be overwritten with new report.

💬 A message to you:

I will try to continuously add new features to DFIRT. If you wish to add functionality, feel free to contribute here.