You must be logged in to sponsor AndrewRathbun

Become a sponsor toAndrew Rathbun

Andrew Rathbun

Michigan

I love sharing with the community and I want to continue doing so! Any support is appreciated!

Featured work

AndrewRathbun/DFIRArtifactMuseum
The goal of this repo is to archive artifacts from all versions of various OS's and categorizing them by type. This will help with artifact validation processes as well as increase access to artifa…
HTML 621
AndrewRathbun/KAPE-EZToolsAncillaryUpdater
A script that updates KAPE (using Get-KAPEUpdate.ps1) as well as EZ Tools (within .\KAPE\Modules\bin) and the ancillary files that enhance the output of those tools
PowerShell 58
AndrewRathbun/DFIRMindMaps
A repository of DFIR-related Mind Maps geared towards the visual learners!
537
nasbench/EVTX-ETW-Resources
Event Tracing For Windows (ETW) Resources
Python 405
AndrewRathbun/VanillaWindowsReference
A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare and see what's been added with each update. Use these CSVs t…
181
AndrewRathbun/VanillaWindowsRegistryHives
A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of every Windows OS version to compare and see what's been added w…
49