Brian Maloney

OneDriveExplorer. OneDriveExplorer is a command line and GUI based application for reconstructing the folder structure of OneDrive from the <UserCid>.dat and <UserCid>.dat.previous file.

SEPparser. Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.

DFIR_Toolbar. Python

ProcDOT-Plugins. Plugins to add funtionality to ProcDOT. http://www.procdot.com

Redline-Process-Tree-Report. Graphical representation of processes from Redline

OCRMe. Tool designed to exfiltrate OneDrive Business OCR Data

KAPE-Automation. PowerShell

Personal-Vault-BEK. Script to automate saving OneDrive PersonalVault BEK file

SmackThatHash. Hashing utility including AmCache SHA1 and QuickXorHash

Surge-collect. Script for deploying surge-collect on Windows

WEF. Various WEF information

Azure-App-IDs. Curated list of well-known app ids

ConsentMonitor. Python

Logparser-Studio-SIRT-Query. Python

Lyman. Lyman’s purpose is to aid in the creation of .cstruct files. These files help to parse OneDrive logs into their components which can lead to better log decryption. By focusing on the data rather than trying to learn how to construct these files, it becomes easier to extract data that otherwise might be missed or misinterpreted.

scripts.

pylnker. This is a Python port of lnk-parse-1.0, a tool to parse Windows .lnk files.

autotimeliner. Automagically extract forensic timeline from volatile memory dump

WMI_Forensics. Python