Skip to content
WMIparser

Posts tagged: #velociraptor

← Back to all posts
How to Collect the WMI Repository for Forensics
Where the WMI repository lives and how to copy OBJECTS.DATA, INDEX.BTR and the MAPPING files safely: shadow copy, KAPE WBEM target, Velociraptor or an image.
wmiacquisitionkapevelociraptor