johnng007/live-forensicator

A suite of Tools to aid Incidence Response and Live Forensics for - Windows (Powershell) | Linux (Bash) | MacOS (Shell)

live-forensicator's Issues

Compress the output

Hello there,

is there anyway to compress the output folder and put it in "tmp" folder or anywhere that doesn't require permissions to access it?

thanks

HTML prints the variable names, not their values

Hi,

Due to single quotes usage on line 1208 and between lines 1210 and 1252, the values in the index.html report of the variables are not printed correctly in the table, instead they are printed literally.

Bac

Ability to run the script in unattended mode

Hi, there is any way to pass the runner parameters in unattended ways without interaction?

Request: PowerShell History of all Users

Hey there!

Currently, the PowerShell history is only retrieved for the running session using Get-History in line 607.
Is it possible to fetch the PowerShell History of all system users by utilizing the following command:

get-content C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt

Depending on how well the whole thing can be parsed into the report.

Keep up the great work!

Forensicator.ps1 command does not work properly

When running the command and after inputing the data the script will freeze at "Gathering Installed Programs". I havent been able to find the reason. All the files seem to be in order.