diff --git a/README.md b/README.md index 976ac02..bec1ca9 100644 --- a/README.md +++ b/README.md @@ -65,7 +65,7 @@ Two different configurations will be created: - dfirws.wsb - network disabled - network_dfirws.wsb - network enabled -This script will also create the file *./setup/config.txt*. Here you can select the tools you would like to be available in the sandbox. All tools will be downloaded and can be installed later in the sandbox if needed. The difference will be the time it takes to start the sandbox. You can also turn off Sysmon and specify the configuration file to use. +This script will also create the file *./setup/config.txt*. Here you can select the tools you would like to be available in the sandbox. All tools will be downloaded and can be installed later in the sandbox if needed. The difference will be the time it takes to start the sandbox. You can also turn off Sysmon and specify the configuration file to use. By default the sandbox will have clipboard redirection off as well as secure defaults for other settings. If you like to enable clipboard copy and paste you should change `Disable` to `Enable`. More information about [Windows Sandbox configuration][wsc]. diff --git a/downloadFiles.ps1 b/downloadFiles.ps1 index 7f140fb..3f85e4e 100644 --- a/downloadFiles.ps1 +++ b/downloadFiles.ps1 @@ -70,6 +70,7 @@ Write-DateLog "Sandboxes done." Copy-Item README.md .\downloads\ Copy-Item .\resources\images\dfirws.jpg .\downloads\ Copy-Item ".\setup\utils\PowerSiem.ps1" ".\mount\Tools\bin\" +Copy-Item .\mount\git\CapaExplorer\capaexplorer.py ./mount/Tools/ghidra/Ghidra/Features/Python/ghidra_scripts # done.txt is used to check last update in sandbox Write-Output "" > .\downloads\done.txt Write-DateLog "Download and preparations done." diff --git a/resources/download/git.ps1 b/resources/download/git.ps1 index 641fd2f..735e12a 100644 --- a/resources/download/git.ps1 +++ b/resources/download/git.ps1 @@ -52,6 +52,3 @@ foreach ($repourl in $repourls) { } Set-Location ..\.. - -# Copy files -Copy-Item .\mount\git\CapaExplorer\capaexplorer.py ./mount/Tools/ghidra/Ghidra/Features/Python/ghidra_scripts diff --git a/resources/download/winget-download.ps1 b/resources/download/winget-download.ps1 index 128317c..8f734ac 100644 --- a/resources/download/winget-download.ps1 +++ b/resources/download/winget-download.ps1 @@ -6,7 +6,7 @@ $SETUP_PATH=".\downloads" Write-DateLog "Download tools via winget." # Local function -function Remove-Tmp { +function Clear-Tmp { if (Test-Path -Path .\tmp\winget) { Remove-Item -Recurse -Force .\tmp\winget > $null 2>&1 } @@ -14,14 +14,14 @@ function Remove-Tmp { # DotNet 6 runtime -Remove-Tmp +Clear-Tmp winget download Microsoft.DotNet.Runtime.6 -d .\tmp\winget > $null 2>&1 Copy-Item .\tmp\winget\Microsoft*.exe .\downloads\dotnet6.exe -Remove-Tmp +Clear-Tmp # VirusTotal CLI -Remove-Tmp +Clear-Tmp winget download VirusTotal.vt-cli -d .\tmp\winget > $null 2>&1 Copy-Item .\tmp\winget\vt-cli*.zip .\downloads\vt.zip & "$env:ProgramFiles\7-Zip\7z.exe" x -aoa "$SETUP_PATH\vt.zip" -o"$TOOLS\bin" | Out-Null -Remove-Tmp \ No newline at end of file +Clear-Tmp \ No newline at end of file