elementary

The elementary tool can process forensicstores created with the artifactcollector.

💾 Installation

Elementary is available as a single binary that does not require installation. It can be used e.g. from a usb stick this way. However different installation options are available to make setup and updating of elementary easier.

homebrew (macOS and Linux)

If you have the Homebrew package manager installed, you can install elementary using:

brew tap forensicanalysis/tap
brew install elementary

scoop (Windows)

If you have the Scoop package manager installed, you can install elementary using:

scoop bucket add elementary https://github.com/forensicanalysis/homebrew-tap
scoop install elementary

deb/rpm (Linux)

Download the .deb or .rpm from the releases page and install with dpkg -i and rpm -i respectively.

manually

The GitHub releases pages provides binaries for all common systems.

🧑‍💻 Usage

For all commands see elementary --help. For all features and flags append --help to any command.

Unpack a forensicstore

elementary archive unpack pc2dd9f0f_2020-05-16T16-46-25.forensicstore

Get connected usb devices

elementary run usb pc2dd9f0f_2020-05-16T16-46-25.forensicstore

Get some autostarts

elementary run run-keys pc2dd9f0f_2020-05-16T16-46-25.forensicstore

List installed services

elementary run services pc2dd9f0f_2020-05-16T16-46-25.forensicstore

List uninstall entries

elementary run software pc2dd9f0f_2020-05-16T16-46-25.forensicstore

List network devices

elementary run networking pc2dd9f0f_2020-05-16T16-46-25.forensicstore

🚫 Limitations

• Most commands only process Windows artifacts
• Prefetch file processing is very slow

💬 Contact

For feedback, questions and discussions you can use the Discussions or the Open Source DFIR Slack.