Artifact Types

You can use the command line options for enabling each artifact type separately when Custom collection profile is selected by providing --profile custom option.

Name Long Form Short Form Default
Active Directory Logs --ADLogs -adl TRUE
Apache Logs --ApacheLogs -apcl TRUE
DHCP Server Logs --DHCPLogs -dhcpl TRUE
DNS Server Logs --DNSLogs -dnsl TRUE
IIS Logs --IISLogs -iisl TRUE
Microsoft Exhange Logs --ExchangeLogs -exchl TRUE
MongoDB Logs --MongoDBLogs -mngl TRUE
MSSQL Logs --MSSQLLogs -mssqll TRUE
Cortana History --CortanaHistory -crtnh FALSE
Microsoft Calendar --MicrosoftCalendar -mclndr FALSE
Microsoft Maps --MicrosoftMaps -mmps FALSE
Microsoft People --MicrosoftPeople -mppl FALSE
Microsoft Photos --MicrosoftPhotosHistory -mph FALSE
Microsoft Sticky Notes --StickyNotes -stckyn FALSE
Microsoft Store Applications List --StoreApplicationsDB -strdb TRUE
Microsoft Voice Record History --VoiceRecordHistory -vrcdh FALSE
Search History --SearchHistory -srch FALSE
Windows Notification History --NotificationHistory -ntfh TRUE
Discord Desktop Cache --DiscordCache -dscrdc FALSE
Microsoft Mail --MicrosoftMail -mml FALSE
Microsoft Outlook --Outlook -outlk FALSE
Mozilla Thunderbird --Thunderbird -thndr FALSE
Skype Databases --SkypeDB -skypdb TRUE
Skype Media --SkypeMedia -skpym FALSE
Teamviewer Logs --TeamviewerLogs -tml TRUE
WhatsApp Desktop Cache --WhatsAppCache -whtc FALSE
WhatsApp Desktop Cookie --WhatsAppCookie -whtck FALSE
Windows Live Mail User Settings --WindowsMail -wndml FALSE
Zoom Databases --ZoomDB -zmdb TRUE
Zoom Media --ZoomMedia -zmm FALSE
Facebook Cache --FacebookCache -fcbkc FALSE
Facebook Databases --FacebookDB -fcbkdb TRUE
LinkedIn Cache --LinkedInCache -lnkc FALSE
Spotify Cache --SpotifyCache -sptfyc FALSE
Spotify Recently Played List --SpotifyList -sptfyl TRUE
Twitter Cache --TwitterCache -twtc FALSE
Twitter Databases --TwitterDB -twtdb TRUE
Evernote Databases --EvernoteDB -everdb FALSE
Evernote Drag and Drop Files --EvernoteDD -everdd FALSE
Evernote Logs --EvernoteLogs -everl FALSE
Everything History --EverythingHistory -evryh FALSE
Notepad++ Sessions --Notepad -ntpd TRUE
OpenVPN Config --OpenVPN -ovpn TRUE
Sublime Text Sessions --SublimeSession -sblm TRUE
iTunes Backups --iTunesBackups -itnb FALSE
VMware Config --VMwareConfig -vmc TRUE
VMware Drag and Drop Files --VMwareDD -vmdd FALSE
VMware Logs --VMwareLogs -vml FALSE
FileZilla Sessions --FileZilla -flz TRUE
Github Desktop Cache --GithubDesktopCache -gthbc FALSE
Github Desktop Databases --GithubDesktopDB -gtdb TRUE
Github Desktop Logs --GithubDesktopLogs -gthbl FALSE
Tortoise Git Logs --TortoiseLogs -trtl TRUE
Visual Studio Team Explorer Config --VisualStudioTeam -vstm TRUE
WSL --WSL -wsl TRUE
Dropbox Cache --DropboxCache -drpc FALSE
Dropbox Databases --DropboxDB -drpdb TRUE
Dropbox Logs --DropboxLogs -drpl FALSE
Google Drive Databases --GoogleDriveDB -gdrvdb TRUE

 

 

Previous Article                                                                                                                     Next Article