{"adoption": {"forks": 280, "observed_at": "2026-08-28T04:04:44.776008+00:00", "stars": 1442}, "canonical_url": "https://ross.abutalabs.com/products/powerforensics", "card": {"archived": false, "artifact_type": "framework", "description": "PowerForensics provides an all in one platform for live disk forensic analysis", "domain": ["security", "windows"], "enriched": true, "function": ["security", "cli", "file-system", "developer-tools"], "health_score": 20, "homepage": null, "language": "C#", "license": "MIT", "license_family": "permissive", "maturity": "maintenance", "member_repos": ["Invoke-IR/PowerForensics"], "name": "Invoke-IR/PowerForensics", "platform": ["windows", "dotnet"], "pushed_at": "2023-11-16T10:31:37+00:00", "repo": "Invoke-IR/PowerForensics", "stars": 1442, "tags": ["digital-forensics", "incident-response", "dfir", "disk-forensics", "ntfs", "fat", "powershell-module", "forensics", "command-line"], "topics": [], "urls": [], "use_cases": ["perform live disk forensic analysis on Windows systems", "parse NTFS and FAT file system artifacts", "support incident response investigations with PowerShell cmdlets", "extract file system metadata during forensic triage", "build custom forensic tooling on a public C# API"], "what_it_is": "PowerForensics is a PowerShell module built on a C# class library that provides an all-in-one framework for live disk forensic analysis. It supports NTFS and FAT file systems, with work begun on Ext and HFS+ support.", "when_to_avoid": ["you need cross-platform forensics on Linux or macOS", "you need support for Ext4 or HFS+ file systems today", "you need actively developed tooling with frequent updates"], "when_to_choose": ["you need scriptable disk forensics on Windows via PowerShell", "you are doing live incident response and want to avoid imaging the drive first", "you want an extensible forensic framework with a public API"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/powerforensics", "repo": "Invoke-IR/PowerForensics", "role": "main", "score": 23}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:04:44.776008+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T04:36:23.194566+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "22bfca647e8e829eff982d1fa5f1206309ac24fcba21b21db5e79ad0dc532af0", "fetched_at": "2026-08-28T04:04:44.776008+00:00", "kind": "readme", "missing": false, "url": "https://github.com/Invoke-IR/PowerForensics"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 0, "longevity": 100, "rhythm": 8}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 4197, "days_push": 1021, "days_rel": null, "gap_med": null, "n_releases_24m": 0}, "score": 23, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}