Skip to main content

Artifacts
Collections
Builder
Converter

Navigate

Artifacts Collections Builder Converter

GitHub(opens in new tab)

Home
Artifacts
Windows
mof

MOF

MOF files (WMI)

Windows
1 path
*.MOF
Version 1
Eric Zimmerman

Paths on disk

1 path

References

1 link

digital-forensics.sans.org/media/DFPS_FOR508_v4.4_1-19.pdf(opens in new tab)

Collect it

KAPE command line for MOF

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target MOF

Run with administrator privileges. KAPE Documentation

Source: KapeFiles/Windows/MOF.tkape(opens in new tab)

The comprehensive resource for Windows forensic artifacts. Search, explore, and generate collection scripts for DFIR investigations.

Navigate

All Artifacts Collections Script Builder Sigma Converter

Resources

GitHub(opens in new tab)KapeFiles(opens in new tab)KAPE Documentation(opens in new tab)SANS KAPE(opens in new tab)

© 2026 DFIRHub. Data sourced from KapeFiles