Evidence Types

You can use the command line options for enabling each evidence type separately when Custom collection profile is selected by providing --profile custom option

 

Name Long Form Short Form Default
Clipboard --Clipboard -clp TRUE
Crash Dump Info --CrashDumpInfo -cdi TRUE
Recycle Bin Info --RecycleBinInfo -rbi TRUE
Restore Point Info --RestorePointInfo -rpi TRUE
Driver Info --DriverInfo -dri TRUE
Process Info --ProcessInfo -pri TRUE
Screenshots --Screenshots -scr TRUE
AntiVirus Info --AVInfo -avi TRUE
DNS Server --DNSServer -dnss TRUE
Proxy Info --ProxyInfo -prxy TRUE
Downloads Info --DownloadsInfo -dli FALSE
Autoruns --Autoruns -aui TRUE
Installed Apps --InstalledApps -apps TRUE
Firewall Rules --Firewall -frwl TRUE
Volume Info --VolumeInfo -voli TRUE
MBR --MBR -mbr FALSE
RAM --RAM -ram TRUE
PageFile --PageFile -pgf TRUE
SwapFile --SwapFile -swp FALSE
Hibernation File --HibernationFile -hbr FALSE
Chrome History --ChromeHistory -chst TRUE
Firefox History --FirefoxHistory -fhst TRUE
IE History --InternetExplorerHistory -ihst TRUE
Edge History --EdgeHistory -ehst TRUE
Opera History --OperaHistory -ohst TRUE
MFT as CSV --MFTCsv -mftcsv TRUE
MFT as Binary --MFTBin -mft FALSE
MFT Mirror --MFTMirr -mftmir FALSE
Ntfs LogFile --NtfsLogFile -ntfslog TRUE
Ntfs UsnJournal --NtfsUsnJournal -usnjrn TRUE
Registry Hives --Hives -hiv TRUE
Registry Hives (Windows.Old) --HivesOld -hivold TRUE
ShellBags --ShellBags -sbgs TRUE
App Compat Cache --AppCompatCache -appcc TRUE
DNS Cache --DNSCache -dnsc TRUE
TCP Table --TCPTable -tcpt TRUE
UDP Table --UDPTable -udpt TRUE
ARP Table --ARPTable -arpt TRUE
IPv4 Routes --IPv4Routes -ipv4 TRUE
Network Adapters --NetworkAdapters -netadp TRUE
Network Shares --NetworkShares -netshr TRUE
Hosts File --HostsFile -hosts TRUE
EVT --EVT -evt TRUE
EVTX --EVTX -evtx TRUE
Event Records --EVTR -evtr TRUE
WMI Active Script --WMIActiveScript -wmiasc TRUE
WMI Command Line --WMICommandLine -wmicec TRUE
Prefetch --Prefetch -pf TRUE
SRUM --Srum -srum TRUE
Activities DB --ActivitiesDb -adb TRUE
AmCache --AmCache -amc TRUE
RecentFileCache --RecentFileCache -rfc TRUE
ETL --ETL -etl FALSE
CLR --CLR -clr FALSE
JumpList --JumpList -jmplst TRUE
LNK Files --LnkFiles -lnkf TRUE
Index Search --IndexSearch -indxs FALSE
SuperFetch --SuperFetch -sprf FALSE
WBEM --WBEM -wbem FALSE
INF LOG --INFLOG -infl FALSE
Shim Database --SDB -sdb FALSE
Powershell --Powershell -pwrs TRUE
Thumb Cache --Thumbcache -tc FALSE
Icon Cache --Iconcache -ic FALSE
RDP Cache --RDPcache -rdpc FALSE

 

 

Previous Article                                                                                                                     Next Article