Add working example output to digital-forensics skills

Adds realistic example output sections to 10 digital forensics skills.
2026-06-15 23:44:56 +03:00 · 2026-03-19 03:05:56 -06:00
parent 1e98186845
commit cfa57cf8bf
10 changed files with 622 additions and 3 deletions
@@ -37,3 +37,54 @@ Reconstruct chronological execution timeline from all Prefetch files.
 ## Expected Output

 JSON report with execution history, suspicious executables, renamed binary indicators, and timeline reconstruction.
+
+## Example Output
+
+```text
+$ python3 prefetch_analyzer.py --dir /evidence/Windows/Prefetch --output /analysis/prefetch_report
+
+Windows Prefetch Analyzer v2.1
+================================
+Source: /evidence/Windows/Prefetch/
+Prefetch Format: Windows 10 (MAM compressed, version 30)
+Files Found: 234
+
+--- Execution Timeline (Incident Window: 2024-01-15 to 2024-01-18) ---
+Last Executed (UTC)     | Run Count | Filename                    | Hash     | Path
+------------------------|-----------|-----------------------------|----------|------------------------------------------
+2024-01-15 14:33:15     | 1         | Q4_REPORT.XLSM-2A1B3C4D.pf | 2A1B3C4D | C:\Users\jsmith\Downloads\Q4_Report.xlsm
+2024-01-15 14:35:44     | 1         | POWERSHELL.EXE-A2B3C4D5.pf  | A2B3C4D5 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
+2024-01-15 14:36:30     | 3         | UPDATE_CLIENT.EXE-B3C4D5E6.pf| B3C4D5E6| C:\ProgramData\Updates\update_client.exe
+2024-01-15 15:10:22     | 1         | NETSCAN.EXE-C4D5E6F7.pf     | C4D5E6F7 | C:\Users\jsmith\Downloads\netscan.exe
+2024-01-16 02:28:00     | 1         | PROCDUMP64.EXE-D5E6F7A8.pf  | D5E6F7A8 | C:\Windows\Temp\procdump64.exe
+2024-01-16 02:30:15     | 2         | MIMIKATZ.EXE-E6F7A8B9.pf    | E6F7A8B9 | C:\Windows\Temp\mimikatz.exe
+2024-01-16 02:40:00     | 4         | PSEXEC.EXE-F7A8B9C0.pf      | F7A8B9C0 | C:\Users\jsmith\AppData\Local\Temp\psexec.exe
+2024-01-17 02:45:00     | 1         | SDELETE64.EXE-A8B9C0D1.pf   | A8B9C0D1 | C:\Windows\Temp\sdelete64.exe
+2024-01-18 03:00:45     | 1         | WEVTUTIL.EXE-B9C0D1E2.pf    | B9C0D1E2 | C:\Windows\System32\wevtutil.exe
+
+--- Renamed Binary Detection ---
+ALERT: UPDATE_CLIENT.EXE loaded DLLs consistent with Cobalt Strike beacon:
+  Referenced DLLs: wininet.dll, ws2_32.dll, advapi32.dll, dnsapi.dll, netapi32.dll
+  Volume: \VOLUME{01d94f2a3b5c7d8e-A4E73F21} (C:)
+  Directories referenced:
+    C:\ProgramData\Updates\
+    C:\Windows\System32\
+
+--- Execution Frequency Analysis ---
+Most Executed (Top 5):
+  1. SVCHOST.EXE          (267 runs)
+  2. CHROME.EXE           (189 runs)
+  3. EXPLORER.EXE         (156 runs)
+  4. RUNTIMEBROKER.EXE    (134 runs)
+  5. OUTLOOK.EXE          (98 runs)
+
+First-Time Executions (Never seen before incident window):
+  6 executables first run between 2024-01-15 and 2024-01-18
+
+Summary:
+  Total prefetch files:         234
+  Suspicious executables:       6
+  Renamed binary indicators:    1 (update_client.exe)
+  Anti-forensics tools:         2 (sdelete64.exe, wevtutil.exe)
+  JSON report: /analysis/prefetch_report/prefetch_timeline.json
+```