search

DFIR-ORC / dfir-orc

Forensics artefact collection tool for systems running Microsoft Windows
https://dfir-orc.github.io
GNU Lesser General Public License v2.1
388 stars 42 forks source link

[feature] Add username in user-related artefacts file names #42

Closed voilaviola closed 3 years ago

voilaviola commented 3 years ago

Hello, I am using the default configuration to fetch user-related artefacts such as NTUSER.DAT. With the current naming method of artefacts (HEXCODE_ARTEFACTNAME.EXTENSION), I find it not very convient to know which artefact belongs to which user. Is it possible to name the acquired file by adding the username ? Such as Administrator_NTUSER.DAT and guest_NTUSER.DAT. By the way, the way I'm using to extract username from these artefacts is processing the artefacts with RegRipper. Do you have a better suggestion with DFIR-Orc? Thank you for developping such a nice tool though.

jeanga commented 3 years ago

Along with each collection with GetThis, you get a GetThis.csv file in the archive. This will provide you with the original full path of the HEXCODE_ARTEFACTNAME.EXTENSION on the source file system.

GetThis is only a file system tool. It has no knownledge of the user associated with the artefact collected (user profiles may or may not be located in c:\Users....). It may also happen to collect ntuser.dat in F:\Backup\whatever\ntuser.dat for instance.

So, it really is up to you processing of archives to understand how (and if) you can associate user names with user hives.

voilaviola commented 3 years ago

Thanks @jeanga ! I didn't notice this.