From 33236312f253203d4f0a58bd2bfe250159a138b1 Mon Sep 17 00:00:00 2001 From: reece394 <31659691+reece394@users.noreply.github.com> Date: Sun, 4 Aug 2024 13:47:53 +0100 Subject: [PATCH 1/2] Change Readme to refer to DFIRBatch instead of Kroll_Batch --- BatchExamples/README.md | 2 +- README.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/BatchExamples/README.md b/BatchExamples/README.md index 00c64f6..d8d7d32 100644 --- a/BatchExamples/README.md +++ b/BatchExamples/README.md @@ -3,7 +3,7 @@ RECmd uses Batch Files (`.reb` file extension) as a means to filter out potentially irrelevant information from the Windows Registry. There is an incredible amount of data stored within the Windows Registry, but much of it is not human readable or useful to an examiner. Batch Files attempt to provide the most high fidelity information and present them in an easy to digest format. -As of 2021, the [Kroll Batch File](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/Kroll_Batch.reb) is the most frequently maintained Batch File. It serves as the default Registry output for KAPE's [!EZParser](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/!EZParser.mkape) Module. This Batch File has been curated to take advantage of most, if not all, available [Registry Plugins](https://github.com/EricZimmerman/RegistryPlugins). +As of 2024, the [DFIR Batch File](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.reb) is the most frequently maintained Batch File. It serves as the default Registry output for KAPE's [!EZParser](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/!EZParser.mkape) Module. This Batch File has been curated to take advantage of most, if not all, available [Registry Plugins](https://github.com/EricZimmerman/RegistryPlugins). ## Disclaimer diff --git a/README.md b/README.md index 29f7915..634a598 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ## Ongoing Projects - * [Kroll Batch File](https://github.com/EricZimmerman/RECmd/projects/1) - Development roadmap for the [Kroll Batch File](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/Kroll_Batch.reb). Please feel free to contribute by adding ideas or by finishing tasks in the `To Do` column. Any help is appreciated! + * [DFIR Batch File (Formally Kroll Batch)](https://github.com/EricZimmerman/RECmd/projects/1) - Development roadmap for the [DFIR Batch File](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.reb). Please feel free to contribute by adding ideas or by finishing tasks in the `To Do` column. Any help is appreciated! ## Command Line Interface @@ -73,7 +73,7 @@ PS> Unblock-File .\Plugins\*.dll RECmd uses Batch Files to make your Registry output more actionable. Learn about Batch Files [here](https://github.com/EricZimmerman/RECmd/tree/master/BatchExamples#readme)! -As of September 2021, there is a README specifically for the Kroll_Batch file used by RECmd and KAPE. Find it [here](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/Kroll_Batch.md)! +As of May 2024, there is a README specifically for the DFIRBatch file used by RECmd and KAPE. Find it [here](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.md)! # RLA From 8225fbe31a5f6079cb1271171e4c35ca9dc00415 Mon Sep 17 00:00:00 2001 From: reece394 <31659691+reece394@users.noreply.github.com> Date: Sun, 4 Aug 2024 14:42:33 +0100 Subject: [PATCH 2/2] Fix Broken !EZParser Link --- BatchExamples/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/BatchExamples/README.md b/BatchExamples/README.md index d8d7d32..b9c2b0f 100644 --- a/BatchExamples/README.md +++ b/BatchExamples/README.md @@ -3,7 +3,7 @@ RECmd uses Batch Files (`.reb` file extension) as a means to filter out potentially irrelevant information from the Windows Registry. There is an incredible amount of data stored within the Windows Registry, but much of it is not human readable or useful to an examiner. Batch Files attempt to provide the most high fidelity information and present them in an easy to digest format. -As of 2024, the [DFIR Batch File](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.reb) is the most frequently maintained Batch File. It serves as the default Registry output for KAPE's [!EZParser](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/!EZParser.mkape) Module. This Batch File has been curated to take advantage of most, if not all, available [Registry Plugins](https://github.com/EricZimmerman/RegistryPlugins). +As of 2024, the [DFIR Batch File](https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.reb) is the most frequently maintained Batch File. It serves as the default Registry output for KAPE's [!EZParser](https://github.com/EricZimmerman/KapeFiles/blob/master/Modules/Compound/!EZParser.mkape) Module. This Batch File has been curated to take advantage of most, if not all, available [Registry Plugins](https://github.com/EricZimmerman/RegistryPlugins). ## Disclaimer