Skip to content

Conversation

reece394
Copy link
Contributor

@reece394 reece394 commented Sep 2, 2025

Description

Added Desktop IconLayouts, DB Browser for SQLite and WinMerge Artifacts. Desktop IconLayouts produces a list of what is present on a users Desktop in order of top left to bottom and then going in column order from left to right until it hits the bottom right. Useful for file presence on Desktop/ Unusual Shortcuts. DB Browser for SQLite and WinMerge are also implemented with Recent File Lists being observed for both which may indicate file access activity.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have generated a unique GUID for my Batch file(s)
  • I have tested and validated the new Batch file(s) against test data and achieved the desired output
  • I have placed the Batch file(s) within the .\RECmd\BatchExamples directory
  • I have set or updated the version of my Batch file(s)
  • I have made an attempt to document the artifacts within the Batch file(s)
  • I have consulted the Guide/Template to ensure my Map(s) follow the same format

Thank you for your submission and for contributing to the DFIR community!

@AndrewRathbun
Copy link
Collaborator

Thank you!

@AndrewRathbun AndrewRathbun merged commit 08604ea into EricZimmerman:master Sep 3, 2025
1 check passed
@reece394 reece394 deleted the dfirbatch branch September 3, 2025 07:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants