How to Collect System Logs within 5 minutes | Best Tool for Incident Response | Easy Log Collection

Remove all your struggle at zero hour using IR-Flash and let's learn how to collect system logs just by one command and within 5 minutes. Working in incident response becomes difficult if you don't have a robust tool/process that can help you to capture your system logs from an infected machine. I have seen many such scenaros where we need to keep asking 100s of people for different types of logs and even many times they don't understand how to collect the logs and what to do. So, I have developed this script which will take all of our pain away and will collect everything and bundle up in a single space.
Ok, so let's now uncover the IR-FLASH tool and let's see what all functionality we can expect out of this tool.

What we are capturing here ?
✔arp table of the current network
✔ipconfig of this machine
✔dnscache
✔ipv4 stack from netsh
✔firewall settings from netsh
✔wifi configuration from netsh (no passwords)
✔System Information
✔Service list
✔Process list
✔Eventlogs- (Application, Security, PS), Defenderlogs, Firewalllogs
✔GPO (text and HTML)
✔Windows Scheduler
✔Audit Policy
✔net user
✔net localgroups
✔net session
✔net share
✔doskey /history
✔powershell logs for all users where accessible
✔Registry
✔AV Vendor logs (Cylance, McAfee, Defender, TrendMicro)- If exists
✔Firewall eventlog
✔registry backup
✔WMI consumer
✔archive of local scripts

-------------------------------------------------------------------------------------------------------------------------
📝
Follow the Steps in GitHub if you missed somewhere in the video. I have explained the steps in written as well.

🔗LINKS FOR YOUR REQUIREMENTS-
-------------------------------------------------------------------------------------------------------------------------

🔥🔥🔥🔥🔥
🔥🔥🔥🔥🔥

WATCH BELOW AS WELL 🔥🔥🔥🔥🔥
-------------------------------------------------------------------------------------------------------------------------

📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ Twitter: @blackperl_dfir

SUPPORT BLACKPERL
-------------------------------------------------------------------------------------------------------------------------
╔═╦╗╔╦╗╔═╦═╦╦╦╦╗╔═╗
║╚╣║║║╚╣╚╣╔╣╔╣║╚╣═╣
╠╗║╚╝║║╠╗║╚╣║║║║║═╣
╚═╩══╩═╩═╩═╩╝╚╩═╩═╝
➡️ SUBSCRIBE, Share, Like, Comment

-------------------------------------------------------------------------------------------------------------------------
🙏 Thanks for watching!! Be CyberAware!! 🤞

#windowslogs #forensic #dfir #blackperl

[BlackPerl]

Hey All. Please let me know how useful this tool gonna be for your day to day life in Incident Response.. Also post all of your queries down here. I will be happy to help!! Enjoy IR Flash!!

[parulkhedwal]

Nice Video Archan...Content Request: Can you make an exclusive video on MITRE please?

[samvarun]

Here in 50secs of upload... Big fan of your work...Many thanks for sharing this will definitely try this out

[futurebuddies]

Excellent work!! This gonna make my life easier from now on!! 😍😍

[zivakhan]

Can't Thank you enough for sharing this one.. Amazing...

[ParlonsCybersecurite]

Hello Archan
I have tried to run the batch file from D:\ drive I faced permission issue ( Access denied ), so I copied "IR-Dump" at the root of C and run the batch file from there, then it worked !
This said, I would like to say thank you for sharing this

[dipubabu]

Brother, Can't thank you enough for the tool! I have been watching your training, it's really good. Kudos !! if you could do some training on forensics it would be appreciated.

[ronmac]

Excellent work man!! Anything similar you have your arsenal for Linux?

[jackjk]

Hi bro.
Can you explain the each logs and it's usage for forensic investigation.

Is there any automated way to find anomalies using the IR flash collect logs and data.

[VaibhavKrishna]

Awesome Archan !! How about getting these event logs into ELK test instance for further analysis? In an automated way.

[nuszkat]

Excellent work. Thanks for sharing this with us.

Recently I have started working in IR and learning about various artifacts that can be collected depending on the nature of the investigation.

I have a question regarding the selection of artifacts this script collects, did you select these artifacts based your previous experience with DFIR investigations where these were found as most valuable or are these based on certain standard procedure guidelines for conducting IR investigations ?

[Nick-snbl]

A linux tool like this would be awesome!

[ManojKumar-ytne]

Could you please guide how to develop your IR-Dump exe application?

[sadunigunasinha]

hey, bro your videos and their contents are really good and quality stuff. I'm really thankful that you sharing your knowledge and your time giving out for free. must say that this script is really saving the day bro thanks again.don't ever stop this it's really helping us your content keep up the good work