Become a sponsor to Andrew Rathbun
I love sharing with the community and I want to continue doing so! Any support is appreciated!
Featured work
-
AndrewRathbun/DFIRArtifactMuseum
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifa…
HTML 536 -
AndrewRathbun/KAPE-EZToolsAncillaryUpdater
A script that updates KAPE (using Get-KAPEUpdate.ps1) as well as EZ Tools (within .\KAPE\Modules\bin) and the ancillary files that enhance the output of those tools
PowerShell 50 -
AndrewRathbun/DFIRMindMaps
A repository of DFIR-related Mind Maps geared towards the visual learners!
-
nasbench/EVTX-ETW-Resources
Event Tracing For Windows (ETW) Resources
-
AndrewRathbun/VanillaWindowsReference
A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update. Use these CSVs t…
-
AndrewRathbun/VanillaWindowsRegistryHives
A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of every Windows OS version to compare and see what's been added w…