Issues

• Split WindowsUserShellFolders

  ForensicArtifacts/artifacts#675 · Filter by author joachimmetz opened on Jul 30, 2026

• Look into overlap MacOSSystemConfigurationPreferencesPlistFile and MacOSSystemPreferencesPlistFile

  ForensicArtifacts/artifacts#614 · Filter by author joachimmetz opened on Feb 18, 2024

• Consider adding %%system_all_volumes%%

  enhancement
  ForensicArtifacts/artifacts#609 · Filter by author joachimmetz opened on Feb 1, 2024

• Split WindowsCortanaDatabase

  ForensicArtifacts/artifacts#601 · Filter by author joachimmetz opened on Jan 12, 2024

• Add VNC password artifact

  enhancement
  ForensicArtifacts/artifacts#587 · Filter by author goldenkirbi opened on Nov 13, 2023
  

• Change legacy definitions to use alias

  code health
  ForensicArtifacts/artifacts#465 · Filter by author joachimmetz opened on Feb 19, 2022

• Add NTFS USN change journal artifact

  blocked
  ForensicArtifacts/artifacts#448 · Filter by author m1435 opened on Dec 22, 2021
  8

• Add outlook extension Windows Registry keys

  ForensicArtifacts/artifacts#410 · Filter by author joachimmetz opened on Jan 9, 2021

• WindowsRegistryProfile requires grr

  question
  ForensicArtifacts/artifacts#407 · Filter by author the-exodus opened on Dec 26, 2020
  6

• Consider how CurrentControlSet and ControlSet### are defined

  ForensicArtifacts/artifacts#401 · Filter by author joachimmetz opened on Sep 29, 2020
  8

• Add artifacts for Powershell command history and logs

  ForensicArtifacts/artifacts#399 · Filter by author sa3eed3ed opened on Jul 31, 2020

• Add definition for Apple TCC MDM overrides

  ForensicArtifacts/artifacts#394 · Filter by author joachimmetz opened on Jun 12, 2020

• Extend WindowsActivitiesCache definition

  ForensicArtifacts/artifacts#376 · Filter by author joachimmetz opened on Jan 19, 2020
  1

• Consider adding artifacts from PowerShell Empire

  ForensicArtifacts/artifacts#360 · Filter by author rgayon opened on Sep 30, 2019
  1

• Consider updating/adding some artifacts from DFIR-ORC

  ForensicArtifacts/artifacts#359 · Filter by author rgayon opened on Sep 30, 2019
  1

• WindowsSystemRegistryFiles add SysWOW64 paths

  enhancement
  ForensicArtifacts/artifacts#355 · Filter by author joachimmetz opened on Jun 25, 2019
  

• Check if LocalServer32 definition should be a value

  ForensicArtifacts/artifacts#348 · Filter by author joachimmetz opened on Jun 13, 2019

• Define behavior of globstar (**)

  enhancement
  ForensicArtifacts/artifacts#342 · Filter by author joachimmetz opened on Jun 9, 2019
  2

  

• Change definitions to use allusersappdata to programdata

  ForensicArtifacts/artifacts#339 · Filter by author joachimmetz opened on May 9, 2019
  1

• Check WindowsUninstallKeys

  ForensicArtifacts/artifacts#329 · Filter by author joachimmetz opened on Mar 30, 2019
  1

• Validate environment variables

  ForensicArtifacts/artifacts#311 · Filter by author joachimmetz opened on Feb 7, 2019
  3

• Validate users variables that are not the first path segment

  ForensicArtifacts/artifacts#310 · Filter by author joachimmetz opened on Feb 4, 2019
  1

• Add validator check for Mac OS private paths

  ForensicArtifacts/artifacts#309 · Filter by author joachimmetz opened on Feb 4, 2019
  

• Clean up WindowsEnvironmentVariableAllUsersProfile

  ForensicArtifacts/artifacts#297 · Filter by author joachimmetz opened on Nov 28, 2018
  

• Consider Adding Windows Backstage Artifacts

  ForensicArtifacts/artifacts#296 · Filter by author broberson344 opened on Nov 7, 2018