PowerForensics
A PowerShell framework for live disk forensic analysis, supporting NTFS and FAT file systems.
What is PowerForensics?
PowerForensics is a PowerShell-based framework for live disk forensic analysis, allowing investigators to examine hard drives on active systems. It provides a comprehensive set of tools for analyzing NTFS and FAT file systems, with plans to support Extended File System and HFS+. The framework solves the problem of needing offline imaging by enabling real-time forensic investigations.
Digital forensics investigators, incident responders, and security professionals who need to perform live disk analysis on Windows systems or removable media.
Developers choose PowerForensics for its extensible public API built on C#, which allows for custom forensic tool development, and its focus on live analysis without requiring drive imaging.
Overview
PowerForensics provides an all in one platform for live disk forensic analysis
Use Cases
Best For
- Performing live forensic analysis on Windows systems
- Investigating NTFS and FAT file systems without offline imaging
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
