These can be IP Addresses, ports when used in WSL and PowerShell cmdlet when PowerShell is used.The new Windows Terminal app is still in active development.
Below is a detailed description of the Windows Terminal artifacts in ArtiFast. Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. This section will discuss how to use ArtiFast Windows to extract Windows Terminal artifact from Windows machines and what kind of digital forensics insight we can gain from the artifact.Īfter you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Windows Terminal artifact: This file is text based and it contains configuration details of the Windows Terminal application.Īnalyzing Windows Terminal Artifact with ArtiFast Windows After installation, the Windows Terminal application creates a “settings.json” file under the C:\Users\%UserProfile%\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\ directory. Windows Terminal is a package that can be installed from the Microsoft Store. Windows Terminal data can be extracted from the following location:Ĭ:\Users\%UserProfile%\AppData\Local\Packages\Microsoft.WindowsTerminal_8wekyb3d8bbwe\LocalState\ Stored values give details about WSL, including remote IP addresses, domain name and port numbers used. Especially the settings of the Windows Terminal provides information about the installed command-line tools. The versatility of the Windows Terminal provides valuable information during the investigations. Windows Terminal can interpret various command-line applications. Windows Terminal can only be installed on Windows 10 version 18362.0 or higher.ĭigital Forensics Value of Windows Terminal Artifact It is a terminal application for command-line tools and shells like command prompt, PowerShell, and Windows Subsystem for Linux (WSL).
Windows Terminal is the modern terminal application in Windows 10 operating system.
0 kommentar(er)
