{"version":1,"pages":[{"id":"kM0UwAhH77R42QRmRt76","title":"WIN-FOR","pathname":"/win-for-documentation","siteSpaceId":"sitesp_UQncJ","description":"A Windows Forensics Toolkit and Environment Builder"},{"id":"twf0C1YZFtPsWwdYSN1M","title":"Using the Installer","pathname":"/win-for-documentation/installation/using-the-installer","siteSpaceId":"sitesp_UQncJ","description":"Win-FOR GUI","breadcrumbs":[{"label":"INSTALLATION"}]},{"id":"ykWn2QQUlKZc9yisgr6W","title":"Acquisition and Analysis","pathname":"/win-for-documentation/the-tools/acquisition-and-analysis","siteSpaceId":"sitesp_UQncJ","description":"Tools used for the acquisition and bulk processing / analysis of evidence items","breadcrumbs":[{"label":"The Tools"}]},{"id":"mmsPm190iHTxfhyvY32z","title":"Databases","pathname":"/win-for-documentation/the-tools/databases","siteSpaceId":"sitesp_UQncJ","description":"Database browsers","breadcrumbs":[{"label":"The Tools"}]},{"id":"SOU53NgrVev2CNXUtmef","title":"Documents / Editors","pathname":"/win-for-documentation/the-tools/documents-editors","siteSpaceId":"sitesp_UQncJ","description":"Applications to create, modify, disassemble, and analyze document files.","breadcrumbs":[{"label":"The Tools"}]},{"id":"bzE8VS9WydzLiw5eYxTD","title":"Email","pathname":"/win-for-documentation/the-tools/email","siteSpaceId":"sitesp_UQncJ","description":"Analyze email artifacts","breadcrumbs":[{"label":"The Tools"}]},{"id":"rn2keUmMFbGKQH4P7L0b","title":"Executables","pathname":"/win-for-documentation/the-tools/executables","siteSpaceId":"sitesp_UQncJ","description":"Reverse engineering, static, and dynamic analysis of executables","breadcrumbs":[{"label":"The Tools"}]},{"id":"NBkbBqmWYtJVpDyA6gWZ","title":"Installers","pathname":"/win-for-documentation/the-tools/installers","siteSpaceId":"sitesp_UQncJ","description":"Decompile and deconstruct installers","breadcrumbs":[{"label":"The Tools"}]},{"id":"44PYAd2J3hOdXhdyw2ly","title":"Logs","pathname":"/win-for-documentation/the-tools/logs","siteSpaceId":"sitesp_UQncJ","description":"Event and Web log analysis","breadcrumbs":[{"label":"The Tools"}]},{"id":"ArQ1PhokkfaNJKlfAGPm","title":"Mobile Analysis","pathname":"/win-for-documentation/the-tools/mobile-analysis","siteSpaceId":"sitesp_UQncJ","description":"Analysis of mobile devices and applications","breadcrumbs":[{"label":"The Tools"}]},{"id":"F1iASdsS3FYxbIxzGZqq","title":"Network","pathname":"/win-for-documentation/the-tools/network","siteSpaceId":"sitesp_UQncJ","description":"Network traffic analysis tools","breadcrumbs":[{"label":"The Tools"}]},{"id":"iSoJsaPO2nYgymwI5Sa8","title":"Raw Parsers / Decoders","pathname":"/win-for-documentation/the-tools/raw-parsers-decoders","siteSpaceId":"sitesp_UQncJ","description":"Basic tools for byte-level analysis of data blobs","breadcrumbs":[{"label":"The Tools"}]},{"id":"uPODYD2ozJAOBCnpj0Wm","title":"Registry","pathname":"/win-for-documentation/the-tools/registry","siteSpaceId":"sitesp_UQncJ","description":"Analysis of Windows registry artifacts","breadcrumbs":[{"label":"The Tools"}]},{"id":"hbsJsQ5rhZ3DU8uMoWvx","title":"Terminals","pathname":"/win-for-documentation/the-tools/terminals","siteSpaceId":"sitesp_UQncJ","description":"Use of Linux-emulated terminals on Windows","breadcrumbs":[{"label":"The Tools"}]},{"id":"W4C26H6rbyymZgMlJ2AO","title":"Utilities","pathname":"/win-for-documentation/the-tools/utilities","siteSpaceId":"sitesp_UQncJ","description":"Basic utilities to assist in data analysis or transfer","breadcrumbs":[{"label":"The Tools"}]},{"id":"k8KTmdT7FKyxMld33iOV","title":"Windows Analysis","pathname":"/win-for-documentation/the-tools/windows-analysis","siteSpaceId":"sitesp_UQncJ","description":"Tools to conduct forensic analysis on various Windows artifacts","breadcrumbs":[{"label":"The Tools"}]},{"id":"fUT9oPi73RQ8XpdbYEs5","title":"Requirements","pathname":"/win-for-documentation/the-tools/requirements","siteSpaceId":"sitesp_UQncJ","description":"Applications required to make everything else work","breadcrumbs":[{"label":"The Tools"}]}]}