Skip to content

Commit 093ca49

Browse files
authored
Update README.md
1 parent 0f5bf25 commit 093ca49

File tree

1 file changed

+18
-14
lines changed

1 file changed

+18
-14
lines changed

README.md

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<h1 align="center">📝 Forensicator 📝</h1>
2-
<h3 align="center">WINDOWS(PowerShell) | LINUX(Bash) | MacOS(Bash) SCRIPTS TO AID LIVE FORENSICS & INCIDENCE RESPONSE</h3>
2+
<h3 align="center"><p><br>WINDOWS(PowerShell) | LINUX(Bash) | MacOS(Bash) </p><br>
3+
<p>SCRIPTS TO AID LIVE FORENSICS & INCIDENCE RESPONSE </p></h3>
34
45
```bash
56

@@ -23,26 +24,26 @@ Live Forensicator is part of the Black Widow Toolbox, its aim is to assist Foren
2324
<p>It achieves this by gathering different system information for further review for anomalous behaviour or unexpected data entry, it also looks out for unusual files or activities and points it out to the investigator.</p>
2425
<p>It is paramount to note that these scripts have no inbuilt intelligence its left for the investigator to analyse the output and decide on a conclusion or decide on carrying out more deeper investigation.</p>
2526

26-
# 🖳 WINDOWS
27+
# 🖳 Forensicator For WINDOWS
2728
<p>The windows version of Forensicator is written in Powershell.</p>
28-
<p> Forensicator analysis Event Logs, it querries the event logs for certain log IDs that might point to an unusual activity or compromise. </p>
29-
[View More On The Windows Tree](https://github.com/Johnng007/Live-Forensicator/tree/main/Windows)
29+
<p> Forensicator for Windows has added ability to analysis Event Logs, it querries the event logs for certain log IDs that might point to an unusual activity or compromise. </p>
30+
[Check out Forensicator for Windows](https://github.com/Johnng007/Live-Forensicator/tree/main/Windows)
3031

3132

32-
# 👨‍💻 MacOS
33-
The MacOS version is written in Bash.
34-
[View More On The MacOS Tree](https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS)
33+
# 👨‍💻 Forensicator For MacOS
34+
<p>The MacOS version is a shell script.</p>
35+
[Check out Forensicator for MacOS](https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS)
3536

3637

37-
# 👩‍💻 LINUX
38-
The Linux version is written in Bash.
39-
[View More On The MacOS Tree](https://github.com/Johnng007/Live-Forensicator/tree/main/Linux)
38+
# 👩‍💻 Forensicator For LINUX
39+
<p>The Linux version is written in Bash.</p>
40+
[Check out Forensicator for Linux](https://github.com/Johnng007/Live-Forensicator/tree/main/Linux)
4041
> #### NOTE:
41-
> The Bash codes were written for cross compatibility so therefore efforts were made to use factory shipped commands and avoid secoundary utitlities like `net-tools`.
42+
> The Bash codes were written for cross compatibility accross linux distros so therefore efforts were made to use OS native commands avoid secoundary utitlities like `net-tools`.
4243
4344

4445

45-
## ✍ Notes
46+
## General Notes
4647
* Run the scripts as a priviledged user to get value.<br>
4748

4849
* Forensicator Activities may be flagged by IDS or IPS Solutions so take note.<br>
@@ -52,10 +53,10 @@ The Linux version is written in Bash.
5253

5354
* <p>Forensicator Has the ability to Search through all the folders within a system looking for files with similar extensions as well known Ransomwares, Albeit this search takes long but its helpful if the Alert you recieved is related to a Ransomware attack</p>
5455

55-
* <p>Forensictor can capture network traffic using netsh trace, this is useful when your investigation has to do with asset communicating with known malicious IPs, this way you can parse the pcapng file to wireshark and examine for C&C servers. By Defult i set the capture to take 120secs</p>
56+
* <p>Forensicator can capture network traffic, this is useful when your investigation has to do with asset communicating with known malicious IPs, this way you can parse the pcapng file to wireshark and examine for C&C servers.</p>
5657

5758
* <p>Sometimes it may be paramount to maintain the integrity of the Artifacts, where lawyers may argue that it might have been compromised on transit to your lab.
58-
Forensicator can now encrypt the Artifact with a unique randomely generated key using AES algorithm, you can specify this by using the -ENCRYPTED parameter. You can decrypt it at will anywhere anytime even with another copy of Forensicator, just keep your key safe. This task is performed by the FileCryptography.psm1 file
59+
Forensicator can encrypt the Artifact with a unique randomely generated key using AES algorithm, you can specify this by using the -ENCRYPTED parameter. You can decrypt it at will anywhere anytime even with another copy of Forensicator, just keep your key safe. This task is performed by the FileCryptography.psm1 file
5960
> #### NOTE:
6061
> This feature is only currently available in the Windows Module..
6162
</p>
@@ -75,6 +76,9 @@ Linux: v1.0 09/06/2024
7576
1. Created Forensicator for Linux machines.
7677
2. Re-arranged the Directory to show that Forensicator has moved from just a powershell tool to a suite of tools.
7778

79+
Windows: v4.0.1 09/06/2024
80+
1. Adjusted Static file references to adapt to the new Forensicator Github structure.
81+
7882
V4.0 13/02/2024 - Big Update
7983
1. General Code Improvement and Standardization.
8084
2. Output HTML File has been improved greatly.

0 commit comments

Comments
 (0)