searchindex.js

Search.setIndex({docnames:["FastFind","FatInfo","GetSamples","GetSectors","GetThis","LO","NTFSInfo","NTFSUtil","ObjInfo","RegInfo","ToolEmbed","USNInfo","architecture","cli_options","configuration","configuring_console_output","configuring_locations","configuring_ntfs_opt","configuring_process","configuring_tool_output","configuring_yara","design_principles","embedded_tool_suite","fs_implem_details","index","info_tools","intro_to_data_collection","licenses","open-license","orc_local_config","outline","platforms","resources","tuto","wolf_config"],envversion:{"sphinx.domains.c":2,"sphinx.domains.changeset":1,"sphinx.domains.citation":1,"sphinx.domains.cpp":3,"sphinx.domains.index":1,"sphinx.domains.javascript":2,"sphinx.domains.math":2,"sphinx.domains.python":2,"sphinx.domains.rst":2,"sphinx.domains.std":1,"sphinx.ext.todo":2,sphinx:56},filenames:["FastFind.rst","FatInfo.rst","GetSamples.rst","GetSectors.rst","GetThis.rst","LO.rst","NTFSInfo.rst","NTFSUtil.rst","ObjInfo.rst","RegInfo.rst","ToolEmbed.rst","USNInfo.rst","architecture.rst","cli_options.rst","configuration.rst","configuring_console_output.rst","configuring_locations.rst","configuring_ntfs_opt.rst","configuring_process.rst","configuring_tool_output.rst","configuring_yara.rst","design_principles.rst","embedded_tool_suite.rst","fs_implem_details.rst","index.rst","info_tools.rst","intro_to_data_collection.rst","licenses.rst","open-license.rst","orc_local_config.rst","outline.rst","platforms.rst","resources.rst","tuto.rst","wolf_config.rst"],objects:{},objnames:{},objtypes:{},terms:{"000":[1,6,7,13,33],"0000":[0,7],"000000":7,"00000000":0,"000000000000":0,"0000000000000026":4,"0000000000000026_kernel32":4,"0000000a":9,"0016":7,"0032":7,"0048":7,"0064":7,"007":0,"0080":7,"0096":7,"00a0c91efb8b":7,"0112":7,"0128":7,"0144":7,"0160":7,"0176":7,"0192":7,"0208":7,"022":7,"043":0,"093":7,"0b1d":7,"0f5acee8e6a4":7,"0x00000000000000":7,"0x0000000000000000":[0,7],"0x0000000000004000":7,"0x0000000000040000":7,"0x00000000005d8600":7,"0x00000000005d9000":7,"0x000000000d295000":7,"0x0001000000000028":7,"0x0001000000000046":7,"0x0001000000000047":7,"0x0001000000000049":7,"0x000100000000049":7,"0x00030000000789d7":0,"0x00080000000e75bc":0,"0x00db00000002442b":6,"0x00ff":6,"0x0badf00d":4,"0x0badf00dbaadf000d":17,"0x100000":7,"0x10200000":7,"0x1f2ffe00":7,"0x1f3ffe00":7,"0x1f400000":7,"0x2200000":7,"0x257ffe00":7,"0x25800000":7,"0x267ffe00":7,"0x26800000":7,"0x4000":6,"0x40b699c7b699bdba":7,"0x4a9b3ee8":7,"0x60669db9669d9080":7,"0x63ffe00":7,"0x692a9cf683ceb91":7,"0x744a3ffe00":7,"0x7470bffe00":7,"0x8000":6,"0x80042302":7,"0x80070001":7,"0x9200000":7,"0xb80097bc00978054":0,"0xd2501a75501a6091":0,"0xfffe00":7,"100":7,"1001":30,"100m":7,"1024":[4,17],"1024mb":4,"104857088":7,"1048576":[7,15,16,19],"10485760":7,"104857600":[7,17],"105906176":16,"107":0,"109":7,"110":7,"119":30,"11d0":7,"11e0":16,"11e9":7,"120":[0,20],"12582912":7,"128":17,"128178376704":30,"12m":7,"132ac043":7,"136362065920":16,"138618":17,"142":30,"14966411":0,"150":4,"15000":4,"15089700864":30,"150mb":4,"159":15,"162":7,"164153534902":30,"16443543502":30,"16777216":7,"168":30,"16mb":2,"17097428992":30,"180":13,"18362":[0,13,33],"1903":[0,13,33],"19041":30,"192":30,"198":33,"1cecafe147f1cc3e2b9804b8cda593c9":0,"1fbb":30,"1mb":[1,6,15],"1yg7bttc":[29,33],"200000":2,"2003":0,"2004":30,"2008":0,"2012":[0,31],"2016":[0,31],"2017":[25,28],"2019":[0,7,13,15,30,31,33],"2020":30,"20200731_105120":30,"2048mb":33,"209":30,"20m":[4,7],"2125":7,"214748364800":16,"214de6b9":30,"219":7,"2199023255040":16,"220":7,"22244237312":30,"247":7,"256":[7,30],"25k":[1,6],"260":7,"264324343432":30,"265":7,"265243332323":30,"266":7,"280":7,"29ff":30,"2a0":30,"2a01":30,"300":[5,28],"321":28,"323":[5,28],"329":7,"33554432":7,"3471674564":30,"357":7,"360":34,"37474009088":16,"3b41cdb194f9":30,"3f0e57c9":16,"3gb":34,"400m":3,"403d":16,"4096":7,"40m":7,"41343243243202":30,"4134548383802":30,"41943040":7,"41d8":7,"430":0,"4300":30,"433":30,"4361":7,"442a60da9b94":16,"444":7,"4564119e":16,"473":7,"475":7,"481":7,"492":7,"499461914112":7,"4b0e":30,"4c12":7,"4cada720":7,"4cdb3ec100de233b393d936d2ee1c33a3":17,"4da1":30,"4shal3tsgydoojalg4ervyru87fwyrcwihzgdfg89e3pbewnyv3j3fr0fvb5t3md":[29,33],"4vdfrqum7e3o6vuarfar8i01ohihzqkjiu1omm2fkmc1":[29,33],"500":4,"500mb":[4,33],"50mb":4,"512":[3,4,7,9,16],"512105932800":30,"512k":7,"512mb":2,"523":7,"523238912":7,"524288000":7,"53f56307":7,"5600":30,"56ae661f8fca":7,"579":7,"593":7,"5mb":3,"5nnygcbluys5gkud1pgauqkhmsmevobzyqcvq3cmw":[29,33],"600":7,"62007541760":16,"630":7,"645922816":7,"65536":7,"670":0,"672":7,"6835":30,"691":0,"694160":0,"6vuoxbo2eba1uomwurrxynyxyffhpvbyxff4udaafivmtegh5vkkym3kj2hi":[29,33],"6xzm4vkint4btgfchg8ano8sjzpetjjadxrigayvlxu4oxfh":[29,33],"70th":7,"722":7,"7437279232":30,"74ff38f4bea0":30,"752":7,"755":7,"7745830912":7,"785":7,"7894ec01651ff3fcdf9d117f416875bbaef03b6d":17,"7ai1xwtjewd1vumkx5q29giufvhvbgn0zhjm5syvdfcqecp":[29,33],"7zip":[4,10,19,32,34],"80mb":4,"8110":30,"8191057920":30,"8192":[0,20],"82horgca":[29,33],"8388608":7,"8650u":30,"878":7,"896":0,"8b106qg":7,"8ca5":7,"8dd1":30,"8e1b":7,"8fa1":30,"90007947c54f9a42":7,"90ghz":30,"927":0,"92aa":16,"937":30,"941":0,"94f2":7,"956":13,"9579":7,"964":7,"96f8":7,"978":7,"9e83":30,"9i1fyqrkguiww7ejxxt3ybl5u":[29,33],"9uyllxu1l":[29,33],"\u00e9ch\u00e9ant":5,"\u00e9galement":5,"\u00e9t\u00e9":5,"\u00e9tabliss":5,"\u00e9tat":5,"\u00e9ventuel":5,"\u00eatre":5,"accord\u00e9":5,"alin\u00e9a":5,"ant\u00e9rieur":5,"autorit\u00e9":5,"boolean":[1,6],"break":31,"byte":[0,1,3,4,6,7,9,15,16,17,19,20],"c\u00e8de":5,"case":[4,9,13,16,17,28,29,31,34],"caus\u00e9":5,"charg\u00e9":5,"class":[17,18,29],"communiqu\u00e9":5,"con\u00e7u":5,"conc\u00e8d":5,"conc\u00e9dant":5,"conf\u00e9rer":5,"conform\u00e9":5,"consid\u00e9r\u00e9":5,"cr\u00e9\u00e9e":5,"cr\u00e9er":5,"d\u00e9cret":5,"d\u00e9faut":5,"d\u00e9fini":5,"d\u00e9riv\u00e9":5,"d\u00e9tenu":5,"d\u00e9tient":5,"default":[0,1,2,3,4,7,8,9,10,11,13,15,16,17,19,25,29,30,32,33,34],"derni\u00e8r":5,"dot\u00e9":5,"dur\u00e9":5,"entit\u00e9":5,"exprim\u00e9":5,"fa\u00e7on":5,"facult\u00e9":5,"final":[12,24],"fran\u00e7ai":5,"function":[1,2,3,4,6,7,14,24,34],"identifi\u00e9":5,"illimit\u00e9":5,"import":[1,6],"int":4,"l\u00e9gal":5,"libert\u00e9":5,"long":[6,9,21],"mentionn\u00e9":5,"new":[7,10,21,24,28,32,33,34],"paternit\u00e9":5,"pr\u00e9judic":5,"pr\u00e9senc":5,"pr\u00e9vue":5,"propri\u00e9t\u00e9":28,"publi\u00e9":5,"public":[5,24,28,30,33],"r\u00e9alis\u00e9":5,"r\u00e9gi":5,"r\u00e9gie":5,"r\u00e9serv":5,"r\u00e9utilis\u00e9":5,"r\u00e9utilisateur":5,"re\u00e7u":5,"return":[2,6,7,9,13],"short":[1,6,9,17,33],"spontan\u00e9":5,"subordonn\u00e9":5,"sugg\u00e9rer":5,"switch":[2,4,10,12],"true":[1,30,33],"try":[3,6,12,33],"utilis\u00e9":5,"while":[4,6,16,17,33],ADS:[4,6,17,22],AND:[9,17],Adding:33,But:[14,33],CMS:[13,21,29,34],DNS:34,DOS:[7,9,34],Des:5,EXE:7,Exe:15,For:[0,1,2,3,4,6,7,8,9,10,11,12,16,17,21,25,32,33,34],IDE:16,Its:[24,28,29,34],Les:5,One:[1,4,6,9,16,20,23,26],SDS:6,SYS:4,Such:[2,32],That:[9,13],The:[0,1,2,3,4,6,7,8,9,10,11,12,13,15,16,17,18,19,20,22,23,24,26,28,29,30,31,32,34],Their:6,Then:[16,17,33],There:[4,9,10,16,22,33],These:[7,10,12,13,24],Une:5,Use:24,Used:[3,4,9],Using:[13,16,23],With:13,Yes:24,_1_data:4,_2_data:4,_data:4,_hive:29,_len_:3,_not_:6,_off_:3,_physicaldrive0_off_0_len_512_mbr:3,_rat:17,_raw:4,_regex:17,_string:4,a21b:30,a30ndtwvsi:[29,33],a90ec9f3:7,a9x61dlm:[29,33],ab41c39a:30,abid:24,abil:[4,10,16,23,31],abl:[2,4,7,9,10,21,23,29,31,34],abort:20,about:[0,1,2,3,4,6,7,8,22,25,30,33],abov:[7,12,16,17,24,29,33],above_normal_priority_class:13,absenc:[2,5,7,28],absent:12,accept:18,accepteula:33,access:[0,1,2,3,4,6,8,13,16,24,31],accomplish:[9,21],accord:[28,33],account:[4,16,33,34],achiev:0,acknowledg:28,acl:[4,23],acquitt:5,action:6,activ:[3,4,16,21,23,24,30,34],actual:[3,6,8,9,13,16,17,20,28,33],adapt:[5,12,28,30,33],add:[0,2,10,14,15,29,33,34],added:[0,1,4,6,10,16,17,21,31,32,33],adding:[16,24,33],addit:[0,9,10,25,33],addition:4,address:[7,21,24,30],administr:[5,8,12,13,16,24,28,31,33],adress:5,ads:[4,17],ads_match:17,ads_regex:17,adss:6,advanc:[12,24],advantag:24,affect:[1,13],afin:5,after:[1,3,6,13,20,21,33],again:33,against:[0,9,17,29,34],aim:[0,13,26,28],ainsi:5,aka:4,algorithm:[4,9,25],alia:[1,6],alias:[1,6],all:[1,2,4,6,7,8,9,10,11,12,13,16,17,18,23,26,28,29,33,34],alloc:7,allocateds:7,allocdelta:7,allow:[0,1,2,3,4,6,7,9,10,12,13,16,17,21,23,24,29,31,33],allusersprofil:16,along:[1,4,6,17,24,33],alongsid:[9,13],alor:5,alpcport:8,alreadi:[4,9,13,19,31,33,34],also:[0,2,3,4,6,8,9,10,11,12,13,14,15,16,17,19,21,24,28,33,34],alter:[13,16],altern:[6,34],altitud:25,alwai:[8,9,12,24,34],alwi:17,ambit:7,amcach:33,among:[1,6],amongst:[3,17],amount:[4,13,21,24,28,34],anad:4,analysi:[0,9,19,21,24,34],analyst:[2,21,24],analyz:[0,2,8,9,11,18,24],anea:4,ani:[0,1,3,4,6,7,9,13,14,16,17,21,24,25,28,29,33,34],anonym:29,anoth:[7,8,9,22,33],ansi:[9,17],answer:33,anti:[4,19],anyth:[15,21],api:[4,7,9,21,29],apparten:5,appdata:[16,30,33],appear:[1,4,6,7,16,24,29,34],append:[4,33,34],appli:[1,2,4,7,13,16,20,25],applic:[4,16,21,23,34],approach:[6,26],appropri:[4,7,12,13,16,21,24,31],apt:[17,24],aqeaiufyratxw5kc:[29,33],aqidaqabo0cwrtbdbgnvhqeepda6gbd47gajks91:[29,33],arbitrari:17,architectur:[7,10,14,21,24,30],archiv:[1,2,3,4,5,6,8,11,13,14,21,24,25,29,30,32,33],archive_format:32,archive_nam:32,archive_timeout:[33,34],area:[6,21],ares:30,arg:10,argument:[0,1,2,4,6,7,9,10,11,12,16,19,21,32,33],aris:24,armi:7,around:[12,24],arrai:17,arriv:21,arsen:26,artefact:[2,17,22,31,33],articl:[5,28],asap:21,ascii:[4,17],asep:[2,21],ask:13,assembl:21,assign:[28,31],assist:4,associ:[0,4,6,9,11,17,31,34],assum:[1,6,33],assur:5,async:29,asynchron:29,attach:[1,6,15,34],attack:24,attempt:[3,13,16,31],attr_match:17,attr_nam:17,attr_regex:17,attr_typ:17,attribut:[0,5,7,9,11,13,19,22,23,25,28,33],attribute_flag_compression_mask:6,attribute_flag_encrypt:6,attribute_flag_spars:6,attribute_list:[6,17],attrid:4,attrnam:4,attrtyp:4,audienc:24,augment:[7,10,33],auteur:5,authent:29,authenticod:[1,6,22],authenticodeca:[1,6],authenticodecathumbprint:[1,6],authenticodesign:[1,6],authenticodesignerthumbprint:[1,6],authenticodestatu:[1,6],author:[6,27,28,30],authorship:28,authschem:29,autom:[2,22],automat:[2,25,34],autoru:7,autorun:[13,21,33],autorunsc:[2,7,10,32,33],autostart:2,autr:5,aux:5,avail:[0,1,2,3,6,7,8,9,11,12,13,16,20,21,28,29,31,32,33,34],available_pagefil:30,available_phys:30,avastar:30,avec:5,avoid:[4,12,13,16,24],avproof:19,awai:[13,31],awar:20,awaymod:[13,29,33],b092e1d683fc21cea137dba2a8b4b08b:17,b475:30,b614:16,b697:30,b6bf:7,ba4d87b7d2ca:7,back:[2,10,14,20,24,29,34],backup:3,bakec2yg5:[29,33],banner:33,base64:[1,6],base:[0,1,5,6,9,10,12,17,19,23,24,29,33,34],basi:28,basic:[1,6,12,26,29,33,34],bat:7,bcryptprimit:0,bd14675a:7,bdd8:30,be0ccf54cdb3ec100de233b393d936d2ee1c33a3:17,bear:33,becaus:[2,6],becom:[20,24],been:[2,4,17,21,24,28,33],befor:[4,9,10,13,14,16,21,24,29,33,34],beforehand:2,begin:[29,33,34],behav:[7,33],behavior:[1,3,6,7,10,13,16,20,21,22,33,34],being:[4,12,13,21,23,33,34],believ:16,below:[1,4,6,7,9,10,12,13,16,17,21,22,28,29,32,33],below_normal_priority_class:[13,18],benefit:[21,23],best:21,better:[4,9],between:[6,10,12,20,23,33],beyond:33,bgnvbamtb0nfulqtrliwhhcnmdqxmjmxmjiwmdawwhcnmtqxmjmxmjiwmdawwja:[29,33],big:[1,6,20],bigger:[1,4,6,7],bin:[3,4,16],binari:[2,7,9,10,12,13,14,17,20,22,24,25,26,32,33,34],bit:[0,7,10,13,29,30,31,33,34],bitlock:16,bitmap:[6,17],bitsuploadcli:29,blob:6,block:[0,4,13,25,34],blocksperindex:7,bncf8hcjesfimidui:[29,33],boihkycig50r5343vt5vjrlmpv16iopgczlxkknfxn480f:[29,33],boot:[3,16,23],bootcod:3,both:[0,1,2,4,6,9,12,14,17,20,21,25,29,33],bound:4,box:24,boyermoor:9,breach:24,breakawayfromjob:13,buffer:[4,20],bug:[7,24],build:[0,12,13,30],built:[6,33],bullet:33,burden:21,bus:3,busybox:33,bypass:4,c048:7,c284:7,c766364efd9c9b5aa3a7140a69f0cf5b147bc476:0,c_drive:33,cab:[1,3,4,6,10,19,32],cabinet:[4,19],cach:4,cadr:5,calc:4,call:[4,6,7,9,12,21,23,33],callback:8,campaign:0,can:[0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,17,19,20,21,23,25,28,29,31,33,34],cancel:[13,34],candid:2,canno:7,cannot:[2,4,9,13,15,16,19,24,28,31],cap:24,capabl:9,capit:9,captur:[16,34],carri:21,carv:6,carvedentri:6,cas:5,cat:17,catalog:[1,6,17],catalogsignedverifi:[1,6],catroot:17,caus:[7,16,28],caution:5,cb04:30,ccf54cdb:17,cell:5,central:12,cepend:5,certain:[6,9,13],certfr:[29,33,34],certif:[1,6,21,29,33,34],ces:5,challeng:24,chanc:2,chang:[0,4,6,7,12,13,23,24,33],charact:[4,9,17,25],charg:28,cheap:17,check:[0,2,24,33],check_associ:0,child:[6,13,34],childdebug:34,children:[12,13,31],choic:[6,10,12,16,21],choos:[7,16,26,33],chosen:[1,17,33],chunk:20,churn:21,circumst:6,circumv:23,cite:24,clarifi:12,classic:[4,10,33],claus:25,clear:[4,13,32],client:[29,34],clone:33,close:13,closest:4,cluster:6,cmd:[10,33],cng:0,code:[1,3,5,6,7,10,12,24,27,28,33],coincid:17,collect:[0,1,2,3,4,6,7,9,11,12,13,16,17,19,21,22,24,30,31,33,34],colon:6,column:[3,4,8,9,11],columnnam:[0,4,8,9,11],com:[6,12,29,30,33],combin:[2,3,4,5,7,9,13,17,28,29,33,34],combinaison:5,come:[7,16,24],comm:5,comma:[0,1,4,6,13,17,20,29,34],command:[0,1,2,6,7,8,9,10,11,14,16,18,19,21,24,25,26,29,30,32,33],command_lin:30,command_timeout:34,commerci:[5,28],commercial:5,commit:34,common:[5,16,24,28],commun:[21,24],communiqu:5,compact:9,compani:[1,6],companynam:[1,6],compar:9,comparison:[9,17],compat:[5,13],compil:[12,24,25,33],complet:[2,4,6,7,9,11,13,16,17,21,23,29,33,34],completeusn:1,complex:[1,2,6,10,12],compli:28,complianc:28,complic:4,comprehens:28,compress:[4,10,21,25,32,34],compris:33,compromis:[0,21,22],compromiss:24,compulsori:[10,29],comput:[0,1,3,4,6,7,8,9,11,13,23,24,33,34],computernam:[0,1,3,4,6,8,9,30,34],concaten:3,concurr:[13,34],condit:[4,5,17,28],conduct:17,confer:28,config:[1,2,4,6,10,12,13,17,30,33,34],configur:[0,1,2,3,4,6,7,8,9,10,11,13,22,24,25,26,31],confirm:33,congest:29,conjunct:13,connect:29,conout:15,consid:[2,9,21,28],consist:[24,29,34],consol:[0,1,2,3,4,6,8,9,11,25,34],constant:6,constrain:17,constraint:[2,4],consum:[1,6,20,34],consumpt:[1,6],contain:[0,1,2,3,4,6,7,9,10,12,14,15,17,21,24,28,29,33,34],contains_hex:17,contenir:5,content:[9,17,20,23,28,32,33,34],contenttyp:4,contenu:5,context:[4,13,24,34],contient:5,continu:[5,28],contrari:10,contributor:27,control:[4,7,9,13,19,21,24,30,31,34],controlset001:9,conveni:[1,6],convent:16,convertstringsecuritydescriptortosecuritydescriptor:6,copi:[4,6,7,10,25,28,29,33],copier:5,copyright:28,core:30,corner:31,corpor:24,correct:[9,33],correspond:[4,12,17,19,33],corrupt:4,cost:17,could:[1,2,6,13,16,17,31],counterpart:33,coupl:17,cours:[12,24,33],cover:[6,7],cpp:15,cpu:[30,34],crash:[13,21,34],creat:[0,1,2,4,6,8,10,11,12,13,15,19,20,21,24,28,29,30,31,32,33,34],create_breakaway_from_job:13,create_new:34,create_suspend:13,createfil:[6,23],createnew:34,creation:[0,1,2,4,6,7,8,13],creationd:[0,1,4,6],creationtim:[6,7],creativ:[5,28],crimin:24,criteria:[9,12,21],criterion:[1,4,6],critic:[24,31],cross:[9,21],crpa:[5,28],cryptograph:[0,1,4,6,23],csidl_admintool:16,csidl_altstartup:16,csidl_appdata:16,csidl_common_admintool:16,csidl_common_altstartup:16,csidl_common_appdata:16,csidl_common_desktopdirectori:16,csidl_common_favorit:16,csidl_common_startmenu:16,csidl_common_startup:16,csidl_cooki:16,csidl_desktopdirectori:16,csidl_favorit:16,csidl_histori:16,csidl_internet_cach:16,csidl_local_appdata:16,csidl_profil:16,csidl_program:16,csidl_program_fil:16,csidl_program_filesx86:16,csidl_startmenu:16,csidl_window:16,csv:[0,1,2,3,4,6,8,9,11,12,15,19,33,34],cumul:[2,4,33],current:[0,2,4,7,8,9,10,11,13,25,29,30,33,34],current_bia:30,current_load:30,currentmajorversionnumb:9,currentvers:[0,9,16],custom:[13,17,24],d2182e5de2b13d2e68ee66d1bb44fe34:17,d41d8cd98f00b204e9800998ecf8427:0,d77:30,d9owpljndsceroumr75hvd47:[29,33],d_imag:16,da39a3ee5e6b4b0d3255bfef95601890afd80709:0,dacl:[4,23],daili:[10,33],damag:28,dan:5,dat:[0,17],data:[0,1,3,5,6,7,9,12,14,16,17,20,21,22,23,24,29,31],data_contain:9,data_contains_hex:9,data_hex:9,data_regex:9,data_s:[0,9],data_size_g:9,data_size_gt:9,data_size_l:9,data_size_lt:9,databas:28,dataid:6,dataindex:6,datanam:7,datas:[6,7],dataset:28,date:[0,1,4,5,6,8,9,28,34],datot:[29,33],daylight:30,daylight_bia:30,dbgeng:32,dbghelp_x64dll:32,dbghelp_x86dll:32,dde981e2:7,ddmp:9,deactiv:1,deal:[7,16,20,24],debc:16,debug:[13,25],debugg:[13,15,34],decad:24,decentr:24,declar:6,decre:28,decrypt:[16,33],dedic:[12,24],deduc:23,deem:10,deepscan:6,default_profil:30,defin:[1,4,6,10,12,13,16,17,21,24,28,29,32],definit:[1,6,17],deleg:21,delet:[0,1,6,21],deliv:13,delta:7,denial:31,depend:[1,4,6,7,9,12,17,21,24,29,31,34],deploi:24,deploy:[24,26,31,33],deprec:[4,6,23],deriv:28,des:[5,28],describ:[0,2,4,6,9,10,11,14,17,29,33,34],descript:[13,21,30,32,34],descriptor:6,deselect:33,design:[1,3,6,8,12,14,24,28,33],desir:[7,9],desktop:[7,13,16,24,29,33],despit:9,dessou:5,destin:[10,33],detail:[0,3,4,7,8,9,10,11,13,17,19,22,25,30,33],detect:[17,33],determin:[1,2,4,6,7,16,24,29],develop:[2,4,12,21],devic:[0,7,8,16,31],device_id:30,dfir:[0,1,2,3,4,6,7,8,9,10,11,14,15,16,19,22,25,26,31,32,33,34],dfir_orc_id:30,diagnos:24,differ:[6,7,9,12,17,21,33],difficult:24,diffus:5,dine:33,dir:[10,30,34],direct:[5,9,12,24],directli:[4,9,10,13,15,23,26,28,32,33,34],directori:[0,1,2,3,4,6,7,8,9,10,11,12,13,16,17,24,25,29,30,33,34],directorynam:34,disabl:[3,13,15,29,34],disable_kei:[13,33],discard:17,disclos:28,disconnect:33,discourag:20,disk:[1,4,6,7,12,13,20,21,23,24,25,30,33],disk_imag:16,diskinterfaceus:3,diskinterfacevolum:7,diskpart:0,disksectors:3,diskvbox_harddisk:16,displai:[0,7,9,13,25,31,33],displayrequir:[13,29],dispon:5,disposit:[5,34],dissemin:28,distinct:2,dll:[0,1,4,6,10,32,33],dll_data:4,dns_server:30,dns_suffix:30,doc:[6,29],document:[0,1,2,3,4,5,6,7,8,9,10,11,12,16,17,22,24,26,28,33],doe:[0,1,2,3,4,6,7,13,15,16,17,23,24,28,29,31,33,34],doesn:19,doing:33,doit:5,domain:[30,34],domaincontrol:[30,34],dommag:5,done:[1,2,16,17,24,25,33],dontshowui:13,dos83:6,download:[16,28,33],dramat:17,drawn:28,drive:[4,6,7,9,25,29],driver:[0,2,4,8,16,17],dry:33,ducer:[29,33],dump:[3,7,9,16,33,34],dump_dir:33,dumpdescript:3,dumpdir:10,dumpnam:3,dumpoffset:3,dumpsiz:3,durat:28,dure:[4,10,13,20,33,34],dword:9,dynam:[2,16],e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855:0,e91b:30,ea_inform:[6,17],ea_match:[4,17],ea_regex:17,each:[0,1,6,7,9,12,16,17,20,21,33,34],eanam:0,eas:[19,21],easi:21,easier:1,easili:[7,24],easiz:6,eb6c:16,ecma:17,ecmascript:9,edit:[0,10,24,30,34],edr:24,effect:[5,13,23,29,33],effici:21,effort:24,efi:3,either:[2,4,9,16,17,19,24,34],elaps:[7,13,33,34],elapsedtimelimit:34,element:[0,7,13,14,15,16,19,20,24,25,33],elev:[12,13,30,33],elimin:17,ell:5,emb:[10,12,14,24,26,32,33],embark:32,embed:[0,2,7,10,12,14,16,20,21,24,25,31,32,34],emerg:24,emphas:17,empti:[1,4,6,8,32,34],enabl:[0,6,13,15,16,21,29,31,34],enable_kei:[13,33],enabled_cor:30,enclos:[0,9],encod:[1,2,4,6,9,13,17,25,29,33,34],encrypt:[4,12,13,16,19,21,29,33,34],end:[1,3,4,6,7,11,13,15,17,19,29,33,34],endian:9,endors:28,engin:[13,20,21,33,34],english:[24,27,30],enhanc:17,enorm:[21,33],enough:8,ensur:28,enterpris:[0,30,33],entier:5,entir:[3,9,25,28,33],entireti:20,entiti:28,entr:[5,28],entri:[0,1,4,6,7,11,16,17,22,24,32],enumer:[1,2,4,6,7,9,11,12,16,17,33],enumloc:12,envelop:[13,29,34],environ:[1,2,6,10,16,24,29,30,33,34],epiwiytqrzoo:[29,33],equal:[9,17],equival:[1,4,6,10,15,16,33],erreur:5,error:[7,8,13,28,31,34],esp:7,especi:[4,9],essenti:10,est:5,establish:33,etalab:[5,28],etc:[0,1,2,3,4,6,12,21,22,28,29,31,33,34],etih:4,etvtnxp29hwg:[29,33],eu6l2xbn8uvllci:[29,33],evad:[9,19],evalu:[1,4,6,12,25,34],even:[1,2,6,9,16,24],event:[0,4,6,8,21,24,31],eventu:[13,17,24,33],ever:24,everi:[0,4,8,9,11,12,15,17,19,23],everyth:[24,33],evolut:24,evolv:[4,24],exact:[9,16,21],exactli:33,examin:[2,4],exampl:[2,3,7,9,12,13,16,19,24,25,32,33],exce:9,except:[9,10,17,33,34],excerpt:33,exclud:[1,2,4,6,16,17,29],exclus:[4,5,17,28,29],exclusif:5,exe:[0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,17,19,20,21,25,29,30,31,32,33,34],execut:[0,1,2,6,10,13,14,15,16,19,20,21,24,25,26,29,32,33],exeintemp:33,exempl:5,exhaust:[29,34],exhibit:[29,34],exig:5,exist:[0,2,4,9,10,13,15,16,17,19,21,28,29,33,34],exit:29,expand:[7,16,34],expans:7,expect:[2,4,7,8,12,21,34],expens:[13,17],experi:13,explain:[9,12,14,16,17,26,32,33],explan:7,explanatori:9,explicit:25,explicitli:[2,4,19,24,29,34],exploit:[5,28],explor:[0,17],express:[1,5,6,9,17,28,34],ext1:[1,6],ext2:[1,6],ext:[1,6],extarch:[1,6],extbinari:[1,6],extend:[6,17,22],extendedattribut:6,extens:[0,1,2,3,6,19,29],extent:[3,4,7,14,23],extern:[12,14,24,33],extra:[1,6],extract:[1,2,3,4,6,10,12,14,33,34],extrair:5,face:24,facilit:[5,28],fact:33,fail:[1,6,7,8,21,31,34],failur:[13,21],fair:5,fait:5,faithfulli:24,fallback:23,fals:[1,3,30,33,34],famili:30,familiar:7,fast:[10,13,19,21,34],fast_find:0,faster:[6,9,23],fastest:[10,13,19,34],fastfind:[8,9,16,17,19,20,21,22,24],fastfind_output:0,fastfind_sqlschema:32,fat32:7,fat:[1,6,22],fatinfo:[13,21,22,24,33],fatinfo_config:10,fatinfoconfig:1,fatinfohashp:[13,33],fatinfohashpe_config:10,faulti:34,favorit:16,fb1948d83d59:7,fe80:30,featur:[1,4,7,16,17,19,23,24,29,34],feb223750981:16,februari:28,feedback:24,feff:30,few:[10,14],fhash1:4,fiddl:12,fidel:4,field:[9,17],figur:[5,12],file:[1,2,3,4,6,7,8,9,11,12,13,14,16,17,20,21,22,23,24,25,27,30,31,32],file_attribute_arch:6,file_attribute_compress:6,file_attribute_directori:6,file_attribute_encrypt:6,file_attribute_hidden:6,file_attribute_norm:6,file_attribute_offlin:6,file_attribute_readonli:6,file_attribute_reparse_point:6,file_attribute_sparse_fil:6,file_attribute_system:6,file_attribute_temporari:6,file_attribute_virtu:6,file_nam:[6,7,17,23],file_name_dos83:7,file_name_win32:7,file_system:30,fileattribut:[7,11],filecopi:29,filefind:9,filefind_match:0,fileinfo:34,fileio:6,filemap:[0,20],filematch:34,filenam:[0,7,33,34],filenamecreationd:[0,4,6],filenameflag:[6,7],filenameid:[6,7],filenameindex:6,filenamelastaccessd:[0,4,6],filenamelastattrchanged:0,filenamelastattrmodificationd:[4,6],filenamelastdatamodificationd:6,filenamelastmodificationd:[0,4,6],fileo:[1,6],files:[0,20],filesystem:1,filetyp:[1,6],fill:[9,11],filter:[1,6,12,34],filterconnectionport:8,fin:5,find:[0,4,6,9,20,33],findmatch:4,fine:[6,24],finish:[7,13,24,33],firm:24,first:[1,4,6,9,10,12,13,17,21,23,24,28,33,34],first_user_defined_attribut:[6,17],firstbyt:[1,6],firstli:[14,24,33],five:6,fix:[9,24,30],flag:[6,7,9],flashback:29,flexibl:21,flush:[9,33,34],flushregistri:[2,4,33],focu:33,folder:[1,2,3,4,6,11,12,13,15,16,20,29,33],follow:[0,1,2,3,4,6,7,8,9,10,11,12,13,15,16,17,19,20,24,25,28,29,30,31,32,33,34],fonction:7,font:5,foo:[0,19],foobar:0,footprint:24,forbidden:9,forens:33,form:[1,6,7,9,11,19,24,30,34],format:[2,4,6,10,11,13,21,25,32],forward:2,fot:30,found:[0,1,3,4,6,7,8,9,11,12,17,33],foundat:[5,28],four:9,fournitur:5,fourth:7,fragil:23,framework:[12,22,26,28,33],franc:[5,28],free:[1,6,24,28,33],freed:6,freeli:28,freespac:30,french:[24,27,28],friendli:1,friendly_nam:30,frn:[0,4,6,11],from:[0,1,2,3,6,7,8,9,10,11,14,15,17,20,21,22,23,24,26,28,29,31,32,33,34],fsctl:23,fsctl_enum_usn_data:23,fsctl_read_usn_journ:11,full:[0,1,3,4,6,8,9,11,14,16,17,33],fullcomputernam:34,fulli:[4,34],fullnam:[0,1,4,6,30],fullpath:11,functionatil:7,further:[33,34],furthermor:17,futur:[4,7],fuzzi:[4,6],fuzzyhash:[4,6],garanti:5,gather:[12,14,21,24],gbkkgh2prxwozk2l6r9gq:[29,33],gdi32ful:0,gdi:0,gener:[1,2,3,4,6,9,13,16,17,24,29,34],generi:[5,28],geometri:23,get:[2,4,14,17,24,25,33],getartefact:[13,33],getartefacts_config:10,getcomputernameex:34,getev:[13,33],getevents_config:[10,32],getexeintemp:33,getexeintemp_config:33,gethives_config:10,getram_winpmem1:29,getsamh:[13,33],getsamhive_config:10,getsampl:[16,19,22,24,32,33],getsamples_sqlschema:32,getsamplesschema:32,getsector:[19,21,22,24],getsecuritydescriptorlength:6,getsystemh:[13,33],getsystemhives_config:33,getthi:[2,6,9,12,16,17,19,20,21,22,24,32,33],getthis_evt:32,getthis_sqlschema:32,getthissampl:4,getthissqlschema:32,getuserh:[13,33],getuserhives_config:10,getwindowsdirectori:16,getyara:[13,33],getyarasamples_config:[10,33],gigabyt:20,git:[4,33],github:[10,12,24,27,33],give:9,given:[4,10,16,20,24,33],global:[4,5,13,16,17,33,34],globalroot:[7,16],goal:[0,12,21],goe:[2,33],going:[13,29,33],good:[24,33],gouv:[24,28],govern:[5,28],gpt:3,gracieux:5,grain:6,grand:5,grandpar:12,grant:28,grantor:28,grasp:4,gratuit:5,great:33,greater:[9,17],group:[1,4,6],grow:24,guarante:[28,33],guid:[7,24],hack:24,had:24,handl:[4,24],hang:[13,21],happen:[2,7,9,10,12,13,16,21,24,33],hard:[0,4,6,7,30],harddisk0:0,harddisk0partition4:16,harddiskvolume16:7,harddiskvolume1:7,harddiskvolume2:7,harddiskvolume3:16,harddiskvolume4:7,harddiskvolume6:16,harddiskvolumeshadowcopy10:16,harddiskvolumeshadowcopy1:7,harddiskvolumeshadowcopy2:7,hardwar:7,has:[0,1,2,4,6,7,9,10,13,16,17,21,28,33],hash1:4,hash:[0,1,4,6,17,20,21,22,23],hasp:[1,6],hasversioninfo:[1,6],have:[0,2,4,6,8,12,16,17,19,21,23,24,31,33],hazard:20,header:[1,3,6,16,17,33],header_hex:17,header_len:17,header_length:17,header_regex:17,held:28,hello:17,help:[1,4,6,7,11,14,24,33],henc:[24,32,33],her:28,here:[0,2,6,9,10,12,23,33],heurist:2,hex:[1,6],hexadecim:[9,11,17],hid:24,hidden:1,hide:9,high:[4,13,29],highest:16,highli:9,highlight:33,hijack:24,hint:33,hip:24,his:28,histor:21,hit:[4,17],hive:[0,4,12,13,17,22,24,31,33],hive_path:0,hkey_current_us:13,hkey_local_machin:4,hkey_local_machinesoftwaremicrosoftwindow:30,hkey_us:4,hklm:16,hoc:21,hold:[6,28],home:30,hook:[4,9,16],hope:24,host:6,hostfilenam:4,hostfrn:6,hotfix_id:30,hour:[13,34],how:[10,12,14,17,21,33],howev:[1,2,4,6,12,13,17,21,24,31,33],htm:6,html:[29,34],http:[3,6,12,28,29,33,34],huge:21,human:11,hve:33,hyberfil:4,hyper:7,hypertext:28,i30:[0,6,7,17],i30info:33,ib3yll:[29,33],idea:[21,24],ident:[1,2,6],identif:[1,6,11],identifi:[0,2,4,5,6,9,16,23,28,30,34],ietf:[29,34],ignor:[0,2,4],illustr:[10,33],ils:5,imag:[1,3,6,7,9,25],immedi:[13,21,23,34],impact:[1,6,13,17,18,24,33],implement:[6,11,25],impli:[1,6,9,13,15,19,20,29],importcsv:32,importcsv_sqlschema:32,impos:[4,17,21,33],improv:[2,24],inaccuraci:28,inact:[0,2,4],incid:[24,33],incl:7,incluant:5,includ:[1,2,6,9,24,28,29,33],incompat:[29,34],incomplet:4,incorrect:[4,7],increas:7,incur:6,inde:[3,7,17,31,33],independ:[9,17,21],index:[6,29,34],index_alloc:[6,17],index_root:[6,7,17],indexedattributetyp:7,indexedattrown:7,indic:[0,1,4,6,17,22,33],indiqu:5,indirect:[5,10],indirectli:28,individu:[4,20,28,29,34],induir:5,influenc:[4,14,24],inform:[0,2,4,7,8,11,15,16,21,22,23,29,31,33],initalis:7,initi:3,initialis:7,inner:[26,29],input:[9,12,21],inse:5,insensit:[9,13,29],insequ:7,insert:33,insid:[0,3,4,6,9,13,16,31,32,33],inspect:[7,9,16],inspector:22,instal:[0,12,24,25],installed_on:30,instanc:[1,6,7,9,12,16,17,24,33,34],instead:[1,2,6,9],institut:[24,28],instruct:33,intact:29,integ:[2,4,17,20],integr:[21,24],intel64:30,intel:30,intellectuel:28,intend:[1,6,7,8,9,11,21,24,28],interact:[0,13,31],interest:[4,16,17],interf:23,interfac:[3,13,16],interfer:[4,28],intern:[10,16],internet:0,interpret:[7,9,11],interven:16,introduc:[30,33],introduct:16,invalid:[1,6,9,16],investig:[7,24],invok:[26,32,33],involv:[12,17,33,34],ioc:20,ioctl_disk_get_drive_geometry_ex:7,ioctl_storage_query_properti:7,ipconfig:34,ipl:3,ipv4:30,ipv6:30,irrelev:10,is_boot:30,is_dll:[0,17],is_not_dl:4,is_system:30,issu:[4,9,19,21,24,28],item:[17,33],its:[0,1,2,4,6,7,9,12,13,14,17,20,21,24,28,29,31,32,33],itself:[6,9,10,12,13,21,23,24],jbootgi:[29,33],jean:[30,33],jeangabook:[0,33],jeopardi:21,job:[8,13,21,29,31,34],job_object_limit_breakaway_ok:[13,31],jobcpulimit:34,jobmemorylimit:34,jour:5,journal:[6,7,11,13,22,23,33],json:[30,34],juridiqu:5,just:[4,7,9,10,33],justifi:[17,21],jzajbgurdgmchquaa4ibaqbgvee7qylvv:[29,33],kb4565627:30,keep:24,kei:[0,6,8,9,14,21,24,33,34],ker:4,kerbero:29,kernel32:4,kernel:21,key_last_writ:30,key_path:[0,9],key_path_regex:9,key_regex:9,keyedev:8,keynam:9,keypath:0,keytre:9,keyword:[4,29,30,33,34],kill:[13,34],kilobyt:[17,20],kind:[9,24,28,33],kindofd:6,kingdom:28,knife:7,know:[6,21,33],knowledg:[5,28],known:[0,7,16,17,21,30,31],knownloc:25,l321:5,label:30,languag:[24,30],larg:[0,5,20,24],larger:[3,4],last:[0,1,3,4,6,9,13,16,24,33,34],lastaccess:0,lastaccessd:[0,1,4,6],lastaccesstim:[6,7],lastattrchanged:[0,4,6],lastchangetim:[6,7],lastentrychang:0,lastli:32,lastmodif:0,lastmodificationd:[0,1,4,6,9],lastmodificationtim:[6,7],lastmodified_kei:0,later:[2,4,11],latter:[14,16,29],launch:[10,12,13,31],launcher:13,law:28,layout:10,lead:[1,4,13],least:[3,4,7,14,17,20,28],left:[24,29],legal:[24,28],length:[3,4,16,17],les:5,lesquel:5,less:[9,17,23,33],let:[13,33],letter:[6,7,16],leur:5,level:[3,4,10,14,16,17,19,24,31,34],leverag:[0,4],libr:5,librari:[9,21,30],librement:5,libyara:20,licens:24,lies:4,life:10,like:[0,1,3,4,6,7,8,9,11,12,15,16,19,23,29,32,33],limit:[2,9,13,20,21,29,33,34],line:[0,1,2,6,7,8,9,10,11,14,15,16,17,18,19,20,21,24,26,29,30,32,33,34],link:[0,4,6,8,28],link_creationtim:0,link_target:0,linkcreationtim:[0,8],linktarget:[0,8],linux:19,list:[0,1,2,4,6,7,8,9,11,12,13,14,16,17,20,21,22,27,29,30,32,34],littl:33,live:[7,12,20,21,33,34],livr:5,load:2,loader:3,local:[4,12,13,14,16,24,30,34],local_load_tim:30,local_unload_tim:30,localconfigfil:29,localservic:30,locat:[0,3,7,11,13,17,22,23,25,29,30,33],location1:[1,4,6],location2:[1,4,6],lock:[4,6,9,20,23,31],log1:33,log2:33,log:[0,1,2,3,4,6,8,9,11,13,21,24,25,31,33],logfil:[1,6,25,33],logged_utility_stream:[6,17],logic:[3,4,7,9],logical_processor:30,logon:13,look:[0,1,3,4,6,7,8,9,11,12,29,33],lookup:0,lorsqu:5,loss:[13,28],lot:[4,20,24,34],low:[3,13,18,24,29,33],lower:[9,31],lowest:[3,6,16],lowestvcn:[6,7],lui:5,lzma:19,machin:[1,11,21,30],machinenam:30,made:[4,28],mai:[4,6,12,13,17,20,21,28],mail:24,main:[0,13,18,24,29,33],mainli:2,maintain:6,major:34,make:[2,3,7,17],malici:[2,4,19],malwar:[4,16,23],manag:21,mandat:28,mandatori:2,manner:[4,16,22,24,33],map:20,marc:33,mark:34,marvel:30,massiv:21,master:[3,7,12,16,22,23,33],match:[1,2,4,6,9,13,17,20,29,33,34],matter:[1,6,13,16],max:4,maximum:[2,3,4,7,10,13,19,28,34],maxlonglong:23,maxpersamplebyt:[2,4,33],maxsamplecount:[2,4],maxsiz:7,maxtotalbyt:[2,4,33],mayb:32,mbr:[3,22],md5:[0,1,4,6,17],mean:[3,14,17,28,29],meaning:[2,4,21],meant:[12,24,33],mechan:[10,13],media:30,megabyt:[17,20],memori:[4,20,21,31,34],mention:5,mentionn:5,menu:[16,25],messag:[7,8,13,29,31,34],met:[1,4],meta:7,metadata:[3,7,22,23],method:[9,12,13,20,29,31],methodolog:24,mettr:5,mft:[0,1,4,6,9,15,17,24,25],mft_data:16,mgr:17,micro:[4,6],microsoft:[0,6,8,13,16,19,24,29,30,31,33],microsoft_reserv:7,miic7tccadmgawibagiqr5af92ti8qtewut3pmvrjzajbgurdgmchquambixedao:[29,33],mimic:7,min:4,mind:24,mine:21,mini:34,minim:[0,2,10,17,18,21,24],minima:5,minima_:5,minimum:[4,24],minist:28,ministr:5,ministri:28,minor:34,minsizerel:33,minut:[13,34],mise:5,mislead:28,miss:[16,17,29,32],mission:[5,28],misspel:13,misunderstood:13,misus:13,mode:[3,7,13,15,29,30],model:30,modern:[21,24],modif:[0,4,9,14,33],modifi:[5,6,7,12,13,28,31,33],modul:[2,20],modular:24,modulo:4,mond:5,monitor:31,monolith:21,more:[0,1,2,3,4,6,7,9,11,12,13,16,19,21,24,29,31,32,34],moreov:21,most:[1,4,6,7,9,10,11,12,16,24,28,33],mostli:[1,2,6,7],mothership:[10,12,32],mount:[0,1,6,7,11,22,25],mounted_volum:30,mountedvolum:7,move:[29,34],moyen:5,mrawdgydvqqdewddrvjuluzsmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkc:[29,33],mscf:19,msdn:[16,31],msec:[7,13,33],much:[11,21,23],multi:9,multin:24,multipl:[0,2,6,16,17,23],multipli:[7,17,20,34],must:[0,1,2,3,4,6,9,10,13,15,16,17,19,24,28,31,33,34],mutant:[0,8],mutex:[0,22],mutual:4,myad:17,mybit:29,myconfig:34,myea:17,myfil:[0,16],myimag:[3,16],myorg:29,myoutput:19,myserv:13,myshar:13,mysteri:33,mytemp:13,mytool:19,myyaracont:20,name:[1,2,3,4,6,7,8,9,11,12,14,15,16,17,20,22,24,28,29,30,32,33,34],name_match:[0,4,17],name_regex:17,namespac:16,nativ:[12,25],natur:[6,21,28],nearli:33,necessari:[10,24,33],necessarili:24,need:[4,9,10,12,13,17,20,21,31,33,34],negoti:29,nest:31,netbio:34,network:[21,29,30,33],networkservic:30,never:13,nevertheless:[4,28],new_dfir:33,next:[21,33,34],nffs_find:17,noconsol:25,noisi:24,nolimit:[2,4,12,33],nom:5,nombr:5,non:[1,4,5,9,13,16,17,28,29,33],none:[4,7,10,13,19,29,34],nonresid:6,nor:[13,28],normal:[10,13,16,19,29,34],normal_priority_class:13,normalis:6,normaliseds:6,notam:5,notat:[10,16,32],notdll:4,note:[1,6,16,34],noth:[7,33],notic:4,notsign:[1,6],nouvel:5,now:[23,33],ntcurrentversionprofilelist:30,ntdll:[0,33],ntf:[0,4,6,7,9,11,12,16,17,22,23,30],ntfs_exclud:[0,25],ntfs_find:[0,25,33],ntfsinfo:[0,4,11,12,13,15,16,19,21,22,24,32,33,34],ntfsinfo_allrecord:34,ntfsinfo_bas:34,ntfsinfo_config:[10,33,34],ntfsinfo_i30info:33,ntfsinfo_output:15,ntfsinfo_secdesc:33,ntfsinfo_sqlschema:32,ntfsinfoconfig:6,ntfsinfohashp:[13,33],ntfsinfohashpe_config:10,ntfsinfosqlschema:32,ntfsutil:[12,19,21,22,24,25,33],ntlm:29,ntopenfil:23,ntuser:[0,17],number:[2,4,6,7,9,13,15,16,20,34],numer:24,obei:24,object:[1,8,12,21,22,24,31],object_find:0,object_id:[6,7,17],object_match:0,objectnam:[0,8],objectpath:[0,8],objecttyp:[0,8],objet:5,objinfo:[0,21,22,24,32],objinfo_schema:32,objinfoschema:32,obsolet:21,obstacl:5,obtain:[1,3,6,9,10,13,24,28,33],obvious:7,occur:[4,31,34],occurr:[1,6,16],odc:[5,28],off:[3,34],offer:[7,21],offici:28,officiel:5,offlin:[7,9,25],offset:[3,7,16],ofset:7,often:13,ogl:[5,28],oldest:11,onc:[4,12,16,24,33,34],one:[0,1,2,3,4,6,8,9,10,11,16,17,19,20,21,28,29,31,32,33,34],ones:[0,4,13,17,23,33],onli:[0,1,2,3,4,6,7,8,9,12,13,15,16,17,21,24,25,29,31,33,34],onlin:[7,9],open:[3,4,8,9,23,24,29,34],oper:[8,10,13,21,29,30,33],operating_system:30,operatingsystem:[0,8],oppos:32,optim:16,option:[12,14,17,18,19,20,21,24,29,33,34],orblvt_20191022_090707:13,orblvtg:[7,13],orblvtg_hiv:13,orblvtg_main:13,orblvtg_yara:13,orc:[0,1,2,3,4,6,7,8,9,10,11,14,15,16,19,22,25,26,31,32,33,34],orc_:29,orc_arch:30,orc_config:[10,33],orc_config_fold:[32,33],orc_detail:29,orc_emb:[10,33],orc_quick:29,orc_workstation_desktop:13,orc_workstation_jeangabook_20190926_145755:33,orc_workstation_jeangabook_h:33,orc_workstation_jeangabook_main:33,orc_workstation_jeangabook_yara:33,orc_workstation_machine_arch:30,orc_x64:[7,10,12,25,30,33],orc_x86:[10,12,32,33],orchestr:[12,24,33],order:[1,3,6,9,12,16,19,24,25,28,34],org:[3,19,29,34],organ:[4,21,24],origin:[1,4,6,12,21,24,28,33],originalfilenam:[1,6],osbuild:[13,30,33],other:[0,1,2,4,6,7,8,9,12,13,14,17,21,28,32,33,34],otherwis:[4,7,16,17,29],our:[32,33],out:[6,7,12,16,19,24,28,33],outfil:33,outil:24,output:[7,13,14,21,25,30,32,33],outsid:3,ouvrir:5,over:[12,23,24,29,33],overal:[1,6],overlap:[0,4,25],overrid:[0,10,13,14,33,34],overridden:[10,12,34],overwrit:[33,34],overwritten:[19,34],own:[12,14,28],owner:6,ownerid:[6,7],ownersid:6,pace:21,page:[16,17],pagefil:[4,20,30,31],pair:17,par:5,paradigm:24,paragraph:[7,28,33],paramet:[1,2,4,6,12,13,16,33],parent:[0,1,4,6,11,12,19,29,34],parentdirectori:7,parentfrn:[0,4,6,11],parentid:2,parentnam:[1,6],parmi:5,pars:[0,1,6,7,9,11,16,22,23,24],parser:[0,1,4,6,7,9,11,12,16,25],part:[2,4,12,16,22,24,26,28],parti:[9,21,24,28],partial:[1,6],particular:[6,17],partir:5,partit:[3,7,22,25],partition0:0,pas:5,pass:[10,11,16,32,34],password:[4,25,29],path:[16,17,20,23,29,30,32,33],path_match:[0,17,33],path_regex:17,pathnam:0,pathtocab:4,pathtodirorarch:4,patrimoin:5,pattern:[4,9,29,34],pdb:0,pehash:6,pemd5:[1,6],pend:[13,34],per:[0,1,4,6,11,13,22,30,34],perform:[1,6,9,15,17,24],period:28,permettr:5,permiss:[4,6,9,31],permit:[9,34],persist:24,person:21,personn:5,pert:5,pertain:7,pesha1:[1,6],pesha256:[1,6],peut:5,peuvent:5,phase:21,physic:[7,9,25,30,34],physical_dr:30,physical_memori:30,physicaldrive0:[3,7,16,30],physicaldrive1:7,physicaldrive_0_offset_1048576:7,physicaldrive_0_offset_524288000:7,physicaldrive_0_offset_629145600:7,physicaldrive_0_offset_645922816:7,physicaldrivevolum:7,physiqu:5,pipe:[0,22],pivot:2,pjh:[29,33],pkc:[13,21,29,34],place:[2,9,17,33],placement:17,plan:7,platform:[1,6,9,10,12,21,31,34],pleas:[0,1,3,4,6,8,9,10,11,12,16,33,34],plu:[5,21,33],pnh:[29,33],point:[2,12,24,28,29,33,34],popsysobj:1,portion:3,posit:17,posix:6,possibl:[1,4,6,7,9,13,14,16,21,23,24,25,28,29,31,32,33],potenti:[4,6,10,14,16,21,24,28],pour:5,pourraient:5,pourront:5,pouvant:5,power:[13,29],powershel:33,powerst:[29,33],pre:[6,12],preced:29,precis:[4,9,17,33],predecessor:34,predefin:3,predetermin:21,prefer:[4,9],prefix:[4,9,17],prejudic:28,premier:5,prepar:2,prerequisit:34,presenc:[0,1,6,16],present:[1,4,6,7,8,9,10,12,13,16,17,33],preserv:[4,34],prevent:[4,13,16,29,31,34],previou:[13,28,34],previous:[9,17,33],pri:5,primari:[3,24],prime:28,principl:[12,24,26],print:[1,6,15],printabl:9,prior:[0,25,29],prioriti:[25,29,33],privat:24,privileg:[8,12,24,29,31,33],probe:1,problem:16,proce:12,procedur:33,proceed:33,process:[2,7,11,13,20,21,25,26,29,30,31,32,33,34],processcpulimit:34,processid:2,processmemorylimit:34,prod_mq01acf050:7,prod_usb_disk_2:7,produc:[9,28,33,34],product:[1,6,24,28],producteur:5,productnam:[1,6],produit:5,profession:[13,24],profil:16,profile_list:30,profilelist:16,profiles_directori:30,program:[3,4,6,7,14,16,24,34],program_data:30,programdata:30,progress:[15,19,24],project:[12,24,33],prompt:[12,13,33],prone:21,properli:13,properti:[7,24],propos:[3,5,7,12,24,28],propr:5,protect:[4,5,12,19,28],protector:7,provid:[0,1,2,4,6,7,9,10,11,16,19,21,22,23,24,33,34],public_path:30,publier:5,publiqu:5,publish:[24,28],pull:[1,6,24],purpos:[0,1,2,3,4,9,13,28,34],pursuant:28,push:24,put:[1,21,33],qfe:[17,30],qqgl1l3mz:[29,33],qsthqiq7f8y5orqwejeqma4ga1ueaxmhq0vsvc1guoiqr5af92ti8qtewut3pmvr:[29,33],qualifi:34,quant:5,que:5,quelconqu:5,quelqu:5,queri:[7,9],question:24,queu:34,queue:[33,34],qui:5,quick:[21,33,34],quickli:[1,4,6,10,24],quiet:15,quit:[7,24],quota:6,qword:9,rang:4,rapport:5,rather:[4,16,24,31],raw:[1,4,6,9,16,33],reach:[2,4,34],read:[0,1,3,4,6,16,17,20,23,33],readabl:11,reader:7,readi:[12,14,33],readingtim:3,real:[29,34],realiz:4,reason:[4,11,21,24,31,33],receiv:28,recent:[6,11,28],recherch:24,recipi:[13,21,33],recognit:[4,28],recommend:[4,9,13,29],recompil:33,reconfigur:[10,33],reconnaiss:5,reconstruct:33,record:[0,1,3,4,6,16,17,23],recordinus:[1,6],recov:6,recoveri:6,recreat:33,recurs:16,recycl:16,redistribu:5,redistribut:[28,32],reduc:[1,6,19,29],reexecut:12,refer:[0,1,2,3,4,6,8,9,10,11,12,14,16,17,20,28,32,33,34],referenc:[6,10,14,24,33],refnum:6,reg_binari:9,reg_dword:9,reg_dword_big_endian:9,reg_dword_little_endian:9,reg_expand_sz:[0,9],reg_full_ressource_descriptor:9,reg_link:9,reg_multi_sz:9,reg_non:9,reg_qword:9,reg_qword_little_endian:9,reg_ressource_list:9,reg_ressource_requirements_list:9,reg_sz:9,regard:[6,13,19],regardless:29,regex:9,regf:[17,33],regfind_match:0,regflushkei:4,reginfo:[0,17,19,20,21,22,24,32],reginfo_config:9,reginfo_output:9,reginfo_sqlschema:32,reginfo_templ:9,reginfosqlschema:32,region:[3,20],regist:[2,17],registri:[4,9,13,17,21,22,24],registry_find:0,regroup:[1,4,6],regular:[9,17],reinvent:21,reject:17,rel:[10,20,34],relat:[1,2,3,4,5,6,7,9,15,17,21,22,25,28,33],relatif:5,relaunch:10,releas:[13,30,33],relev:[12,24],reli:[2,4,9,22,23,32],reliabl:[4,21,22,24],remain:[10,16,24,34],remot:[29,33],remov:[1,6],renvoy:5,reparse_point:[6,17],repeat:[13,29,33,34],replac:[3,4,30],report:[0,6,8,13,17,22,24,34],reportal:[4,33],repositori:[10,12,24,27,33],repres:[4,9,16,21,34],reproduc:28,reproduir:5,request:[3,12,23,24],requir:[0,1,4,6,12,14,16,21,24,25,28,33],rerun:34,res:[20,32,33,34],reserv:[11,28],reset:13,resid:[1,4,6],resili:13,resolv:[16,30],resourc:[0,1,6,10,12,14,20,24,31,33,34],resource_nam:32,respect:[5,13,16,17,20,28,33],respond:[24,33],respons:[5,24,28,33],ressource_nam:32,restor:[24,34],restrain:24,restrict:[4,23],result:[0,1,2,3,4,6,7,8,9,10,12,13,14,16,21,24,25,28,33,34],resurrect:[1,6],resurrectrecord:[1,6],retriev:[0,7,9,17,28],reus:21,reuser:28,rev_pmap:7,revamp:24,reveal:33,revers:[1,6],revert:10,review:24,rfc2315:[29,34],right:[4,33],risk:24,roam:16,role:0,romanc:30,root:[0,1,2,4,6,9,10,29,34],rootkit:0,routin:11,royaum:5,rtm:[0,13,30,33],rule:[0,1,4,6,9,12,17,20,24,33],ruleset:[10,20,33],run32:34,run64:34,run:[0,1,2,4,7,8,9,12,13,14,26,29,30,31,32,33,34],runonc:9,safe:[7,24],sai:[16,17],said:13,sake:4,sam:33,same:[0,2,4,6,7,9,11,16,20,21,25,27,29,33,34],sampl:[0,3,12,16,17,19,22,33],samplenam:4,san:5,satisfi:[4,28],scalabl:24,scale:24,scan:20,scan_method:[0,25],scanner:[0,4,25],scenario:[10,12,14,33],schedul:[10,12,13,24],schema:[30,32],scheme:29,scope:[4,17,33],scr:[1,6],script:[10,13,17,21],scsi:[7,16],sddl:6,search:[0,4,9,12,25,33],searchterm:9,sec:7,secdescr:33,secdescrid:6,secdescrs:6,second:[4,9,20,21,33],secondli:[14,24,33],section:[0,4,8,14,17,29,32,33,34],sector:[3,7,16,23],sectors:7,secur:[1,6,19,23,24,33],security_descriptor:[6,17],securitydirectori:[1,6],securityhealth:0,securityid:7,see:[2,6,7,9,10,13,19,29,32,33],seem:[7,19,33],seen:12,segment:[4,7,23],segreg:21,select:[1,4,6,7,9,13,16,17,19,29,33],selector:16,self:[9,10,32,33,34],selon:5,semaphor:8,semicolon:[0,17,20,29],sen:5,sens:[3,7,29,34],sensit:[9,17,21],sent:[15,24],separ:[0,1,4,6,9,11,13,17,20,21,29,34],sequenc:[6,12],serial:[7,30],server:[0,12,29,30,34],servernam:29,servic:[7,9,24,28,30],serviceprofil:30,ses:5,session:[8,21],set:[1,2,4,6,7,8,9,10,12,13,16,17,18,21,24,28,29,33,34],setthreadexecutionst:29,setupapi:3,seul:5,sever:[6,17,24,33,34],sha1:[0,1,4,6,17],sha256:[0,1,4,6,17],shadow:[0,6,7,25],share:[4,9,12,20,23,28,29],she:28,shell:33,shortli:[7,24],shortnam:6,should:[2,4,7,9,10,11,12,16,17,19,20,23,28,29,33,34],show:[13,33],shown:[12,13],sid:[6,30],side:21,sidl_bitbucket:16,sidl_startup:16,sign:[1,2,6],signatur:[0,1,2,6,16,21],signedhash:6,signednotverifi:[1,6],signedverifi:[1,6],signer:[1,6],signific:24,silent:2,similar:[2,6,33],similarli:34,simpl:[1,10,19],simplest:19,simpli:[9,12,16],simplifi:[1,6,9],sinc:[0,1,2,12,33],singl:[4,8,12,24,34],siren:5,site:33,situat:[16,24],size:[0,1,2,4,6,7,9,10,16,17,19,20,30,33],size_eq:17,size_g:17,size_gt:17,size_l:17,size_lt:17,sizeatleast:7,sizegt:[1,6],sizeinbyt:[0,1,4,6],sizelt:[1,6],sizeperindex:7,skeleton:[29,33,34],skevr5vbdsxtqhtehys4k:[29,33],skip:34,slack:[3,22],sleep:[13,29],slow:[6,21],smaller:[1,2,4,6,7,11],smb:[12,29],snapshot:[0,4,6,7,9,11,24],snapshot_id:0,snapshotid:[0,4,6,11],softwar:[0,4,9,12,13,16,17,24],sole:[13,28],solut:[16,33],some:[1,3,6,9,12,14,16,19,21,33],somedirectori:29,somehow:33,somelimitofyourchoic:33,someotherlimittochoos:33,someth:3,sometim:[7,33],sont:5,soon:24,sophist:0,sort:[5,6,28],souhait:5,soumis:5,sourc:[0,4,5,12,15,24,25,27,28,33,34],sp1:[0,31],sp2:[0,31,32],sp3:0,space:[3,4,6,11,21,22],span:[13,33],speak:24,spec:[29,34],special:[16,21,24],specif:[0,1,3,4,9,16,17,21,23,24,26,28,29,33,34],specifi:[0,1,2,3,6,8,9,10,11,12,14,16,17,19,20,23,29,34],split:[1,6],spontan:28,spy:24,ssdeep:[4,6],ssi:24,sss:[0,4],ssw0rd:29,stabl:24,stack:16,stand:24,standalon:0,standard:[1,6,9,21,30],standard_bia:30,standard_inform:[6,7,17],standardinform:0,standbi:13,start:[2,3,7,10,11,13,14,15,16,24,30,33],startup:[2,13,16],state:[4,24,28,29,30],statement:33,statu:[1,6,23,28,30],stderr:[33,34],stdout:[33,34],stdouterr:[33,34],step:[2,9,12,14,21,24,30],still:[2,4,9,16,31],stop:[4,7,34],storag:[6,16],storageaccessalignmentprop:7,storageaccessalignmentproperti:7,store:[1,2,4,6,10,16,17,33],straightforward:19,strategi:25,stream:[6,7,17],strict:[4,21,23],strictli:24,string:[0,1,4,6,9,10,17,30,32],strive:21,structur:4,studi:24,studio:[24,25,33],sub:[6,10],subent:16,subject:28,subkei:9,submiss:2,submit:24,subprocess:[12,34],subsequ:13,subset:[1,6,34],substitut:[1,10,29,34],subsystem:[1,6],success:0,successfulli:[7,12],successor:34,suffici:[9,33],suffix:[4,20,34],suggest:28,sui:[5,28],suit:[7,12,13,16,21,24,31,33],suitabl:24,summar:30,supersed:33,suppli:[4,17,28],support:[0,2,4,7,10,13,16,17,19,24,29],suppos:33,suppress:4,sur:5,swiss:7,symbol:[0,8],symboliclink:[0,8],sync:29,synchron:29,syntax:[0,1,2,3,4,6,7,8,9,10,11,13,15,16,17,19,29,33,34],sys:[0,1,6,17],sysintern:[2,12,21,33],system32:[0,4,17,30,34],system:[1,2,3,4,6,7,8,9,10,13,16,17,18,19,20,21,22,24,25,29,31,33,34],systemat:[1,6],systemdr:[0,4,6,9,16],systeminfo:[13,33],systemprofil:30,systemrequir:[13,29,33],systemroot:[16,33],systemtyp:34,systemwid:33,syswow64:[0,30],szoid_common_nam:[1,6],szoid_organization_nam:[1,6],szoid_organizational_unit_nam:[1,6],szoid_rsa_emailaddr:[1,6],tabl:[3,7,9,12,16,22,23,33],tacit:[5,28],tag:[1,6,9,13,30,33],tail:[15,19],take:[0,2,4,7,9,10,12,13,19,21,24,29,33,34],taken:[4,9,16,33,34],tamper:16,target:[0,2,4,6,8,10,12,21,24,34],task:[12,13,34],tasxplhxrsi:[29,33],tcpdump:21,team:21,techniqu:[6,9,24],technolog:21,tel:5,tell:5,temp:[0,1,2,4,6,8,9,11,12,13,15,16,19,29,30,33,34],templatenam:9,temporari:[2,4,12,13,21,33,34],temporarili:[13,31],tenu:5,term:[5,9,17,28],termin:[13,34],test:[0,1,6,9,12,13,17,19,24,31],testcas:16,text:[4,13,29,32],than:[1,2,4,6,7,9,16,17,19,28],thank:10,thei:[0,1,6,7,9,17,19,24,28,33],them:[4,9,12,20,26,31,33],therefor:[4,9,17,24],thi:[0,1,2,3,4,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,26,29,30,31,32,33,34],thing:[1,6,33],third:[7,9,21,28],those:[0,1,2,4,6,9,17,28,29],though:16,thousand:0,thread:[18,29],thread_priority_below_norm:18,threat:[0,24],three:[0,1,4,7,16,24,33],threshold:9,through:[2,10,12,23,31,33],throughout:30,thu:[9,12,13,16,21,24,31,32,33],thumbprint:6,tier:5,time:[2,3,4,6,7,13,15,21,24,30,31,33,34],time_zon:30,timeout:[0,4,13,25,33,34],timestamp:[1,6,11,22,30,34],titr:5,tlsh:[4,6],tmp:16,too:[9,10,13],tool:[0,1,2,3,4,6,7,8,9,10,11,13,14,15,16,17,18,25,26,29,31,32,33,34],toolchain:33,toolemb:[2,12,14,22,24,32,33],toolembed_sqlschema:32,toolset:12,top:[4,7,17,21],total:[4,13,33],toto:17,tou:5,tout:5,toward:24,trace:[0,15,24],track:[24,33],transact:33,transfer:[28,33],transform:[5,9,28],translat:16,transmettr:5,transmit:[10,28],treat:[7,17],treatment:21,tree:9,trend:[4,6],triag:[4,24],trick:16,trigger:[2,12,17],truncat:[3,15,34],trust:24,tsv:9,tune:[21,24],turn:2,tutori:[10,14],twice:13,two:[0,4,6,7,8,9,10,11,14,17,20,21,23,33],txt:[0,4],type:[0,1,3,4,6,7,8,9,13,17,30,33,34],typic:[0,2,3,8,9,10,11,12,13,16,19,20,21,25,29,32,33,34],typicalconfig:4,uac:12,uefi:3,ulterior:0,ultim:12,ultra:[10,13,19,32,34],umdfcommunicationport:8,unabl:31,unalloc:3,unalt:24,uncompress:[2,4],unconfigur:[7,10,12,25,32,33],under:[1,6,9,13,17,21,24,28,34],underli:7,underscor:4,understand:[10,14,24],une:5,unexpect:1,unhandl:34,uni:5,unicast:30,unicod:[4,9],unifi:19,uniqu:[1,6,9,21,34],unit:[2,4,21,28,30],unknown:[1,6],unleash:14,unless:4,unlik:[1,6,15],unlimit:[28,34],unmodifi:[10,29],unnam:17,unnecessari:12,unpredict:[1,6],unreli:[1,6,20],unrestrict:28,until:[2,4,34],unus:6,unxor:4,updat:[6,25,28,31],upload:[12,13,33,34],upon:[0,21,34],upper:2,url:5,usabl:[12,24,29,34],usag:[5,21,24,25,33],usbstor:[7,16],use:[1,2,3,4,6,7,9,10,11,12,14,16,17,19,20,21,28,29,31,32,33,34],used:[0,1,2,3,4,6,7,8,9,10,11,12,13,15,16,17,19,21,23,28,29,30,31,32,33,34],useful:[7,10,16,24,33],user:[1,3,6,10,13,16,17,21,24,29,33],usernam:30,userpres:[13,29],userprofil:16,uses:[0,7,9,10,11,16,20,29,33],using:[0,1,2,3,4,6,7,9,10,11,12,13,14,15,16,17,19,20,21,23,24,25,29,31,32,33,34],usn:[6,11,22,25,33],usninfo:[13,16,21,22,24,32,33,34],usninfo_sqlschema:32,usninfosqlschema:32,usual:[3,7,12,14,19,21,24,33],utc:[7,13,15,30,33],utf16:[2,9,19],utf8:[2,9,13,19,33],utf:4,util:[7,22],utilis:5,utmost:17,v10:30,valid:[1,4,6,7,9,21,34],valu:[0,2,3,4,7,9,13,16,17,19,20,29,30,33,34],value_dumpfil:9,value_hasbadchar:9,value_notinh:9,value_pres:9,value_regex:9,value_typ:9,valuedata:9,valuedumpfil:9,valueflag:9,valuenam:9,values:9,valuetyp:9,vari:19,variabl:[1,2,6,9,10,20,25,29,34],varieti:21,variou:[4,7,17,21,24,29],vbr:[3,22],vcn:6,ven:7,ven_kingston:16,ven_msft:16,ven_toshiba:7,ver:5,verbos:[2,6,25,34],veri:[6,17,21,33],verifi:[1,2,6,17],version:[1,5,6,7,13,15,21,24,27,28,30,31,33,34],version_info:[1,6],versioninfo:[1,6],vertu:5,vhd:7,via:[4,9,16,28,32,33],view:[6,24,29,34],vigueur:5,violat:4,virtual:[6,7],viru:4,virus:[4,19],visant:5,vista:[0,6,21],visual:[13,24,25,33],vocat:5,voisin:5,volatil:4,volstat:1,volum:[0,3,4,7,9,11,12,21,23,25,30,33],volume_id:0,volume_inform:[6,17],volume_nam:[6,17],volumeentri:1,volumeid:[0,1,4,6,11],volumesentri:6,votr:5,vss:[6,9,16],vss_volsnap_attr_autorecov:7,vss_volsnap_attr_client_access:7,vss_volsnap_attr_differenti:7,vss_volsnap_attr_no_auto_releas:7,vss_volsnap_attr_persist:7,wai:[1,4,6,9,10,11,12,19,31,33],wait:[24,34],waiv:4,walk:[6,7,23],walker:[1,6,7,15],want:[17,21,33],warn:[2,7,13],warranti:24,webrequest:33,websit:33,welcom:2,well:[21,23,28],wer:[13,34],werdontshowui:34,were:[4,6,24,33],what:[4,7,10,12,13,21,33],whatev:21,wheel:21,when:[0,1,2,3,4,6,7,9,10,11,12,13,16,17,19,20,23,24,28,29,31,32,33,34],whenev:21,where:[0,2,3,4,9,10,11,15,16,19,24,29,30,31,33],wherea:17,whether:[0,1,2,4,6,13,23,24,29],which:[0,1,2,3,4,6,7,9,10,11,12,13,17,20,21,22,24,28,29,33,34],white:4,who:28,whole:[4,12,17,21,24],whose:[9,16,17,29],why:[7,10,21,33],wide:21,widest:28,wiki:3,wikipedia:3,wildcard:16,win32:[0,6],win32_process:13,win:33,winbas:29,windir:34,window:[3,4,7,8,13,16,17,21,24,25,29,30,33,34],windows10:[13,30,33],windowst:8,winver:34,wireless:30,wish:[24,28],within:[4,13,15,16,17,28,31],without:[9,10,12,16,22,24,28,33],wolf:13,wolf_config:19,wolflauch:7,wolflaunch:[10,12,13,14,24,30,32,33],wolflauncher_config:[10,32],wolflauncher_sqlschema:32,wolflaunchersqlschema:32,word:13,work:[9,12,16,24,26,33,34],workingtemp:[13,29,30,33],workload:18,workstat:[0,13,30,33,34],world:[17,21],worldwid:28,would:[1,4,6,17,20,24,32],writabl:19,write:[0,1,4,6,7,10,13,17,21,24,32,33],writeabl:15,written:[2,4,6,9,13,15,17,19],wrong:16,wstcodec:4,www:[5,6,19,28],x64:[0,7,13,30,32,33],x86:[13,30,32,33],xml:[0,1,2,4,6,9,10,12,13,14,15,16,17,19,20,21,29,32,33,34],xmllite:[10,32],xmllite_x86_xpsp2:32,xmllite_x86dl:[10,32],xor:4,xor_0badfood_0000000000000026_kernel32:4,xor_:4,xor_pattern:4,xor_xorpattern:4,xore:4,xorpattern:4,xxx:28,y5b0sr5vupmfeqakoxbxlmb8votnkn:[29,33],yara:[10,12,13,17,25,33],yara_rul:[0,4,17],yarac:20,yararul:4,year:24,yes:[0,1,2,3,4,6,8,9,10,11,16,29,33,34],yet:[9,33],yield:[1,10,12,17,33],you:[4,6,7,17,21,33],your:[12,26],yyyi:[0,1,4,6],yyyymmdd_hhmmss:[30,34],zero:23,zip:[1,3,4,6,10,25,34],zone:6},titles:["FastFind","FatInfo","GetSamples","GetSectors","GetThis","LICENCE OUVERTE 2.0/OPEN LICENCE 2.0","NTFSInfo","NTFSUtil","ObjInfo","RegInfo","ToolEmbed","USNInfo","Architecture","DFIR ORC Command-line Options","Configuration","Configuring Console Output, Logging","Configuring Locations","Configuring Attributes of <code class=\"docutils literal notranslate\"><span class=\"pre\">ntfs_find</span></code> and <code class=\"docutils literal notranslate\"><span class=\"pre\">ntfs_exclude</span></code> Elements","Configuring Process Priority","Configuring Tool Output","Configuring the Yara Scanner","Design Principles","Embedded Tool Suite","Implementation Details About Parsers","Introduction","Common Options &amp; Properties","Design and Architecture","Licenses","OPEN LICENCE 2.0/LICENCE OUVERTE 2.0","DFIR ORC Local Configuration File","DFIR-ORC Execution Outline","Requirements","Referencing Resources in Configurations","Tutorial","WolfLauncher Configuration File"],titleterms:{"2003":31,"2008":31,"caract\u00e8r":5,"compatibilit\u00e9":5,"d\u00e9finit":5,"default":6,"donn\u00e9":5,"final":33,"pr\u00e9sent":5,"propri\u00e9t\u00e9":5,"r\u00e9utilis":5,"responsabilit\u00e9":5,Are:24,One:21,The:[21,33],Use:33,Will:24,about:[23,28],add:[1,6],addfil:10,addit:[4,16],algorithm:17,all:21,altern:4,altitud:16,anssi:24,applic:[5,28],approach:21,architectur:[12,26],archiv:[10,19,34],archive_timeout:13,arg1:2,arg2:2,argument:34,arsen:21,artefact:24,attribut:[1,2,4,6,10,15,16,17,20,29,34],attrinfo:6,automat:16,autorun:2,behind:21,binari:[1,6,21,30],bit:12,bitlock:7,block:20,boss:33,build:[24,33],can:24,cett:5,challeng:33,charact:19,childdebug:13,choos:21,claus:17,column1:1,column:[1,6],columnselect:[1,6],command:[4,12,13,34],command_timeout:13,common:25,compact:11,compat:28,compress:[13,19],compressionlevel:13,compromis:24,config:[0,9],configur:[12,14,15,16,17,18,19,20,21,29,30,32,33,34],consol:15,content:[1,4,6,24,25],context:30,contribut:24,copi:16,cover:28,createnew:13,criteria:[1,6],custom:3,customoffset:3,customs:3,data:[4,28],debug:15,defaultcolumnselect:6,definit:28,deploy:12,descript:[0,1,2,3,4,6,7,8,9,11],design:[21,26],detail:[1,6,23],develop:24,devic:3,dfir:[12,13,21,24,29,30],digit:24,directli:12,directori:19,disable_kei:29,discoveri:[1,6],disk:[3,16],drive:16,droit:5,dump:10,edit:33,element:[1,2,4,6,9,10,17,29,34],emb:21,embed:[22,33],enable_kei:29,encod:19,enumloc:7,evalu:17,exampl:[1,4,5,6,10,15,17,28,29,30,34],execut:[12,30,34],expertis:24,explicit:16,extend:4,fastfind:0,fatinfo:1,few:[24,33],file1:0,file:[0,10,15,19,29,33,34],fileinfo:6,filenam:[4,9],filesystem:0,forens:24,format:19,framework:[21,24],frn:7,from:[4,12],get:[1,6],getsampl:2,getsector:3,getthi:4,getthisarg:2,getthisconfig:2,hardwar:30,has:24,help:25,hexdump:7,hive:9,how:24,i30info:6,identifi:24,imag:16,implement:23,inform:[1,5,6,9,28,30],input:[10,34],intellectu:28,intellectuel:5,introduc:24,introduct:24,invok:12,kei:[13,29],keyword:13,known:32,knownloc:16,legacybootcod:3,legisl:28,level:13,liabil:28,licenc:[5,28],licens:27,limit:4,line:[4,12,13],list:33,loc:7,local:[29,33],locat:[1,4,6,9,16],log:[15,34],logfil:15,machin:24,main:21,maintain:24,make:24,malici:24,match:0,mft:[7,16,23],mini:33,mothership:13,motto:21,mount:16,name:[0,10],need:24,no_journ:13,nochilddebug:13,noconsol:15,nosigcheck:2,notlowinterfac:3,nowait:13,ntfs_exclud:[4,9,17],ntfs_find:[4,9,17],ntfsinfo:6,ntfsutil:7,object:0,objinfo:8,offlin:16,omit:[1,6],onc:13,onli:19,open:[5,28],option:[0,1,2,3,4,6,7,8,9,10,11,13,15,16,25],orc:[12,13,21,24,29,30],order:17,other:24,out:[0,1,2,3,4,8,9,10,11,13],outlin:[30,34],output:[0,1,2,3,4,6,8,9,10,11,15,19,29,34],outputfold:13,ouvert:[5,28],overlap:20,overwrit:13,pair:10,parser:23,partit:16,password:19,path:[0,1,2,3,4,6,8,9,10,11],person:28,personnel:5,physic:16,possibl:17,powerst:13,preservejob:13,principl:21,prioriti:[13,18],process:[12,18],profil:30,properti:[25,28],propo:5,quick:[1,6],recipi:[29,34],record:7,referenc:32,reginfo:9,registri:0,registry_find:9,releas:24,requir:[13,31],resourc:32,ressourc:10,restrict:34,result:17,retriev:4,reus:28,right:28,run32:10,run64:10,run:[10,21,24],sampl:[2,4],sampleinfo:2,scan_method:20,scanner:20,search:17,secdescr:6,server:31,shadow:16,should:24,size:3,skipdelet:0,slackspac:3,slackspacedumps:3,sou:5,sound:24,sourc:20,sp3:31,specif:[12,13],specifi:4,step:33,still:24,strategi:16,stream:4,suit:22,support:25,syntax:32,system:[0,12,30],tabl:[24,25],tee_cleartext:13,tempdir:[2,13],tempfold:13,templat:9,temporari:29,test:33,them:21,thi:28,timelin:[2,6],timeout:20,timeoutvalu:13,tool:[12,19,21,22,24],toolemb:10,tutori:[24,33],typic:[1,4,6,15,17],uefiful:3,uefifullmaxs:3,upload:29,usag:[0,1,2,3,4,6,7,8,9,10,11,15,16,17],use:24,used:24,user:30,usn:[7,23],usninfo:11,valu:[1,6,10],variabl:[16,32],verbos:15,version:[0,25],versionstr:0,vista:31,volum:[1,6,16],vss:7,wai:24,warm:33,warn:[24,31],well:32,werdontshowui:13,what:24,who:24,why:24,wildcard:4,window:[0,1,6,31],wmi:13,wolf:34,wolflaunch:34,written:24,yara:[0,4,20],yarafile1:0,your:21,zip:19}})