Skip to content

Update DFIRBatch.reb with Windows Notepad #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 3 commits into from
Closed

Update DFIRBatch.reb with Windows Notepad #90

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
389ead5
Update DFIRBatch.reb with Windows Notepad
ogmini Jun 18, 2025
d902844
Update DFIRBatch.reb - remove trailing whitespace
AndrewRathbun Jun 18, 2025
8b489b8
Update DFIRBatch.reb - update to 2.12, fix comments, fixes for linter
AndrewRathbun Jun 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions BatchExamples/DFIRBatch.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ Special thanks to those who have contributed to this Batch file:
* [Tony Knutson](https://twitter.com/bigt252002)
* Chris Kudless
* [Reece394](https://github.com/reece394)
* [ogmini](https://github.com/ogmini)

# Version History

Expand Down Expand Up @@ -58,6 +59,7 @@ Example entry, please follow this format:
| 2.09 | 2024-12-19 | Added Angry IP Scanner Artifacts |
| 2.10 | 2025-01-18 | Added System ProductType and ProductSuite Artifacts |
| 2.11 | 2025-03-31 | Added Threat Hunt for WinLogon Shell and Userinit values |
| 2.12 | 2025-06-18 | Added Windows Notepad Artifacts |

# Documentation

Expand Down
31 changes: 29 additions & 2 deletions BatchExamples/DFIRBatch.reb
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
Description: DFIR RECmd Batch File
Author: Andrew Rathbun, esecrpm
Version: 2.11
Id: 6e68cc0b-c945-428b-ab91-c02d91c877b8
Version: 2.12
Id: 6e68cc0b-c945-428b-a‘b91-c02d91c877b8
Keys:
#

Check warning on line 6 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

6:1 [comments-indentation] comment not indented like content
# DFIRBatch README: https://github.com/EricZimmerman/RECmd/blob/master/BatchExamples/DFIRBatch.md
# => Add changelog in this readme after additions.
#
Expand Down Expand Up @@ -44,7 +44,7 @@
Recursive: false
Comment: "Displays the username of the last user logged in to this system"

# https://windowsir.blogspot.com/2013/04/plugin-winlogon.html

Check warning on line 47 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

47:1 [comments-indentation] comment not indented like content

-
Description: WinLogon
Expand All @@ -55,7 +55,7 @@
Recursive: false
Comment: "Displays the SID of the user who is set to auto login to Windows"

# https://windowsir.blogspot.com/2013/04/plugin-winlogon.html

Check warning on line 58 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

58:1 [comments-indentation] comment not indented like content

-
Description: WinLogon
Expand Down Expand Up @@ -130,7 +130,7 @@
Recursive: false
Comment: "Identifies the system volume where Windows booted from"

# https://www.microsoftpressstore.com/articles/article.aspx?p=2201310

Check warning on line 133 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

133:1 [comments-indentation] comment not indented like content
# https://stackoverflow.com/questions/15361617/retrieve-the-partition-number-of-bootmgr-on-windows-vista-and-later

-
Expand All @@ -142,7 +142,7 @@
Recursive: false
Comment: "Displays value for the current ControlSet"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 145 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

145:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -154,7 +154,7 @@
Recursive: false
Comment: "Displays value for the default ControlSet"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 157 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

157:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -166,7 +166,7 @@
Recursive: false
Comment: "Displays value for the ControlSet that was unable to boot Windows successfully"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 169 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

169:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -178,7 +178,7 @@
Recursive: false
Comment: "Displays value for the last known good ControlSet"

# https://what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-3/

Check warning on line 181 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

181:1 [comments-indentation] comment not indented like content
# https://msirevolution.wordpress.com/2012/03/31/what-is-currentcontrolset001-in-windows-registry/

-
Expand All @@ -192,7 +192,7 @@
BinaryConvert: FILETIME
Comment: "Last system shutdown time"

# https://www.winhelponline.com/blog/how-to-determine-the-last-shutdown-date-and-time-in-windows/

Check warning on line 195 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

195:1 [comments-indentation] comment not indented like content

-
Description: Windows OS Language
Expand All @@ -203,7 +203,7 @@
Recursive: false
Comment: "Default OS Language, 0409 is English"

# https://serverfault.com/questions/957167/windows-10-1809-region-language-registry-keys

Check warning on line 206 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

206:1 [comments-indentation] comment not indented like content
# https://www.itprotoday.com/windows-78/where-registry-language-setting-each-user-stored

-
Expand Down Expand Up @@ -3048,6 +3048,33 @@
Recursive: true
Comment: "Displays artifacts relating to Angry IP Scanner"

# Third Party Applications -> Windows Notepad

-
Description: Windows Notepad
HiveType: OTHER
Category: Third Party Application
KeyPath: Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
Recursive: true
Comment: "MRU from .\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat”

Check failure on line 3059 in BatchExamples/DFIRBatch.reb

View workflow job for this annotation

GitHub Actions / lintAllTheThings 

3059:30 syntax error: found unknown escape character 'A' (syntax)
-
Description: Windows Notepad
HiveType: OTHER
Category: Third Party Application
KeyPath: Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
Recursive: true
Comment: "TypedPaths from .\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat”
-
Description: Windows Notepad
HiveType: OTHER
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have we tested if this works in RECmd? I don't think this is a valid HiveType but I'd have to check....

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ogmini FYI ^^

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RECmd/RECmd/ReBatch.cs

Lines 36 to 56 in 0c5b479

public enum HiveType_
{
[Description("Other")] Other = 0,
[Description("NTUSER")] NtUser = 1,
[Description("SAM")] Sam = 2,
[Description("SECURITY")] Security = 3,
[Description("SOFTWARE")] Software = 4,
[Description("SYSTEM")] System = 5,
[Description("USRCLASS")] UsrClass = 6,
[Description("COMPONENTS")] Components = 7,
[Description("DRIVERS")] Drivers = 8,
[Description("AMCACHE")] Amcache = 9,
[Description("SYSCACHE")] Syscache = 10,
[Description("BCD")] Bcd = 11,
[Description("BCD-Template")] BcdTemplate = 12,
[Description("ELAM")] Elam = 13,
[Description("userdiff")] userdiff = 14,
[Description("BBI")] Bbi = 15,
[Description("VSMIDK")] Vsmidk = 16,
[Description("DEFAULT")] Default = 17
}

It appears that Other is a valid HiveType. If we can confirm this works, then game on 👍

Category: Third Party Application
KeyPath: Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
Recursive: true
Comment: "MountPoints2 from .\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\SystemAppData\Helium\User.dat”

# https://ogmini.github.io/2025/06/12/Windows-Notepad-Revisiting-Application-Hive.html
# https://ogmini.github.io/research#windows-notepad

# --------------------
# CLOUD STORAGE
# --------------------
Expand Down
Loading