Having fun while learning about and pivoting into the world of DFIR.
by ogmini
Finally got a few minutes to start working on writing the KAPE Target for Windows Notepad. It will grab the Tab State, Window State, and settings.dat files that I’ve talked about in my research. Pretty straightforward process and I just want to do a little more testing and make sure I have everything right before I submit a Pull Request.
I’ve also started on writing a KAPE Module that leverages my Windows Notepad Parser that will generate CSV files from the above KAPE Target. I’m hoping I can get this all done this weekend in between normal work.
tags: DFIR - Windows Notepad - KAPE