Invoke-IR/PowerForensics

Health v2 · maintenance only

Adoption not part of the score

1442 stars · 280 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

PowerForensics is a PowerShell module built on a C# class library that provides an all-in-one framework for live disk forensic analysis. It supports NTFS and FAT file systems, with work begun on Ext and HFS+ support.

Use cases

• perform live disk forensic analysis on Windows systems
• parse NTFS and FAT file system artifacts
• support incident response investigations with PowerShell cmdlets
• extract file system metadata during forensic triage
• build custom forensic tooling on a public C# API

When to choose

• you need scriptable disk forensics on Windows via PowerShell
• you are doing live incident response and want to avoid imaging the drive first
• you want an extensible forensic framework with a public API

When to avoid

• you need cross-platform forensics on Linux or macOS
• you need support for Ext4 or HFS+ file systems today
• you need actively developed tooling with frequent updates

Facets

framework · maturity maintenance

security cli file-system developer-tools security windows windows dotnet digital-forensics incident-response dfir disk-forensics ntfs fat powershell-module forensics command-line

Member repositories

For agents

markdown · JSON · MCP: product_card(name="Invoke-IR/PowerForensics")