IRCollect

About: IRCollect is a script and collection of tools to help with IR Forensics on Windows 7 and higher systems.


Requires:
Windows 7 or higher and admin rights. Tools need to be in the same directory as the script. All tools are in archive tools.zip

Tools:
systernals - https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite
rawcopy - https://github.com/jschicht/RawCopy
winpmem - https://github.com/insystemsco/IR_Collect
openedfilesview.exe - https://www.nirsoft.net/utils/opened_files_view.html
mmls.exe - https://github.com/insystemsco/IR_Collect
Browser History View - https://www.nirsoft.net/utils/browsing_history_view.html
Browser Addon View - https://www.nirsoft.net/utils/web_browser_addons_view.html
Cports - http://www.nirsoft.net/utils/cports.html
7zip - https://www.7-zip.org/
Hollows Hunter - https://github.com/hasherezade/hollows_hunter

Other useful tools:
Volatility Memory Forensics - https://www.volatilityfoundation.org/
Loki Scanner - https://github.com/Neo23x0/Loki
Yara - https://virustotal.github.io/yara/