CrowdStrike_RTR_Powershell_Scripts
CrowdStrike_RTR_Powershell_Scripts copied to clipboard
freeload101
RECON IR Recycled bin
Set-Variable -Name ErrorActionPreference -Value SilentlyContinue
(Get-ChildItem -Path 'C:$Recycle.Bin' -Force -Recurse) | select * | ForEach-Object {
Write-Output ($_).FullName
if ((($).Name -match '$') -and ((Get-Item ($).FullName).length -lt 500 )) {
((Get-Content ($_).FullName) -replace ".*\u0001.", "Meta: " -replace "\u0000", "")
}
}
The random file names are killing me ...I have no way to know if the random file is a metadata file or the file itself ...
