search

AndrewRathbun / DFIRPowerShellScripts

Various PowerShells scripts I've made (or others have made) to automate some of the boring stuff in my everyday DFIR journey!
MIT License
44 stars 15 forks source link

MFTECmd$J$MFTParser.ps1 - add --KAPE switch #1

Closed AndrewRathbun closed 1 year ago

AndrewRathbun commented 2 years ago

https://github.com/AndrewRathbun/DFIRPowerShellScripts/blob/main/MFTECmd%24J%24MFTParser.ps1

Add a switch parameter --KAPE, which will search for MFTECmd.exe with existing code. When switch isn't present, the user will have to put where mftecmd.exe resides. This will allow script to be ran both in KAPE and standalone.

AndrewRathbun commented 1 year ago

https://github.com/AndrewRathbun/DFIRPowerShellScripts/commit/c188ae4fe3adaf8b1710f43eef3c36d61760d23c - done