The purpose of PowerForensics is to provide an all inclusive framework for hard drive forensic analysis.
PowerForensics currently supports NTFS and FAT file systems, and work has begun on Extended File System and HFS+ support.
All PowerForensics documentation has been moved to Read The Docs.
Detailed instructions for installing PowerForensics can be found here.
PowerForensics is built on a C# Class Library (Assembly) that provides a public API for forensic tasks.
The public API provides a modular framework for adding to the capabilities exposed by the PowerForensics module.
All of this module’s cmdlets are built on this public API and tasks can easily be expanded upon to create new cmdlets.
API documentation can be found here.
The pgrep command in Linux finds the PIDs of running processes based on a name or other…
The unlink command in Linux removes a single file by deleting its directory entry. It is a…
When troubleshooting a network connection or configuring a firewall, the first question is whether a…
The ifconfig command in Linux displays and configures network interfaces. It can assign IP addresses, bring interfaces…
The groupdel command in Linux removes a group from the system. It deletes the group's entry from /etc/group and /etc/gshadow,…
The wc command in Linux counts lines, words, characters, and bytes in files or standard input. It…