DFIRHub

CombinedLogs

Collect Event logs, Trace logs, Windows Firewall, PowerShell console logs, and .NET CLR UsageLogs

  • Compound
  • 31 paths from 7 artifacts
  • Per-user data
  • Version 1.3
  • Mike Cary, Mark Hallman added the USBDevicelogs target, Thomas DIOT (Qazeer) added the .NET CLR UsageLogs and PowerShell Transcripts target

Paths on disk

31 paths from 7 targets

Paths use Windows environment variable syntax

Includes 7 targets

Each one is collected with this target

Notes

v1.1 - Added the USBDevicelogs target

v1.2 - Added the .NET CLR UsageLogs target

v1.3 - Added the PowerShell Transcripts target