Invoke-IR / ForensicPosters

https://github.com/Invoke-IR/ForensicPosters

• Invoke-IR/ForensicPosters GPT;
• Invoke-IR/ForensicPosters $UsnJrnl_$J;
• Invoke-IR/ForensicPosters Registry_NamedKey;
• Invoke-IR/ForensicPosters $UsnJrnl_$Max;
• Invoke-IR/ForensicPosters Registry_Header;
• Invoke-IR/ForensicPosters 0_MFT;
• Invoke-IR/ForensicPosters Prefetch101;
• Invoke-IR/ForensicPosters 0x10_$STANDARD_INFORMATION;
• Invoke-IR/ForensicPosters 7_$Boot(VBR);
• Invoke-IR/ForensicPosters 4_$AttrDef;
• Invoke-IR/ForensicPosters 0x20_$ATTRIBUTE_LIST;
• Invoke-IR/ForensicPosters 0xXX_NonResident;
• Invoke-IR/ForensicPosters 0x30_$FILE_NAME;
• Invoke-IR/ForensicPosters _MBR;
• Invoke-IR/ForensicPosters 0x60_$VOLUME_NAME;
• Invoke-IR/ForensicPosters 0xA0_$INDEX_ALLOCATION;
• Invoke-IR/ForensicPosters 0x70_$VOLUME_INFORMATION;
• The Windows PowerShell Logging Cheat Sheet;
• Invoke-IR/ForensicPosters 0x80_$DATA;
• Invoke-IR/ForensicPosters 0x90_$INDEX_ROOT;