Skip to content

Commit

Permalink
True -> true, False -> false to make YAML linter happy
Browse files Browse the repository at this point in the history
  • Loading branch information
AndrewRathbun committed Feb 12, 2022
1 parent e4af2fc commit 4e56081
Show file tree
Hide file tree
Showing 11 changed files with 20 additions and 20 deletions.
6 changes: 3 additions & 3 deletions Targets/Apps/Zoom.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -8,21 +8,21 @@ Targets:
Name: Zoom client logs
Category: Apps
Path: C:\Users\%user%\AppData\Roaming\Zoom\logs
Recursive: True
Recursive: true
FileMask: "*"
Comment: "Zoom client artifacts"
-
Name: Zoom client logs (Windows XP)
Category: Apps
Path: C:\Documents and Settings\%user%\Application Data\Zoom\
Recursive: True
Recursive: true
FileMask: "*"
Comment: "Zoom client artifacts (Windows XP)"
-
Name: Zoom client recordings
Category: Apps
Path: C:\Users\%user%\Documents\Zoom\
Recursive: True
Recursive: true
FileMask: "*"
Comment: "Zoom recording artifacts"
-
Expand Down
8 changes: 4 additions & 4 deletions Targets/Apps/pCloudDatabase.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -2,28 +2,28 @@ Description: pCloud Database
Author: Josh Hickman
Version: 1.0
Id: dc6750d8-ee91-45d4-9f53-fa3f8513ada3
RecreateDirectories: True
RecreateDirectories: true
Targets:
-
Name: pCloud Database
Category: Apps
Path: C:\Users\%user%\AppData\Local\pCloud\
FileMask: '*.db'
Recursive: False
Recursive: false
Comment: "Database contains all files sync'd with pCloud account."
-
Name: pCloud Database WAL File
Category: Apps
Path: C:\Users\%user%\AppData\Local\pCloud\
FileMask: '*.db-wal'
Recursive: False
Recursive: false
Comment: "Write-Ahead Log for pCloud database file."
-
Name: pCloud Database Shared Memory File
Category: Apps
Path: C:\Users\%user%\AppData\Local\pCloud\
FileMask: '*.db-shm'
Recursive: False
Recursive: false
Comment: "Shared Memory for the pCloud database file."

# Documentation
Expand Down
2 changes: 1 addition & 1 deletion Targets/Compound/MessagingClients.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Description: Messaging and communication apps
Author: Gregor Wegberg
Version: 1.0
Id: c6d3b238-0be7-4764-afa7-9224e46097c0
RecreateDirectories: True
RecreateDirectories: true
Targets:
-
Name: IRC Clients
Expand Down
2 changes: 1 addition & 1 deletion Targets/Compound/ServerTriage.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Description: A compound target for gathering artifacts common to servers.
Author: Eric Capuano
Version: 1.0
Id: 9bea625c-00bd-4389-a0a5-f648e8e267ce
RecreateDirectories: True
RecreateDirectories: true
Targets:
-
Name: WebServers
Expand Down
2 changes: 1 addition & 1 deletion Targets/Compound/USBDetective.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Description: Collects files that can be input into USB Detective for parsing
Author: Kevin Pagano
Version: 1.0
Id: 6c3f8a69-f529-4201-a00e-067f6db7be8e
RecreateDirectories: True
RecreateDirectories: true
Targets:
-
Name: USBDevicesLogs
Expand Down
2 changes: 1 addition & 1 deletion Targets/Compound/WebServers.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Description: Logs from all known web server applications and supporting services
Author: Eric Capuano
Version: 1.0
Id: 38de27ae-5047-404b-a7e1-3c99071724d5
RecreateDirectories: True
RecreateDirectories: true
Targets:
-
Name: Apache Access Logs
Expand Down
2 changes: 1 addition & 1 deletion Targets/CompoundTargetGuide.guide
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ Description: Name of application/artifact here # Required, this will be visible
Author: Your name here # Required
Version: 1.0 # Required, increment as revisions are made.
Id: Unique GUID here # Required, generate within gKape by double clicking on a Target or Module, then click Generate GUID button at bottom of popup window, paste GUID here.
RecreateDirectories: True # Required, true means the folder structure of the artifacts will be created within the user-specified Target Destination directory. If an artifact is buried 10 folders deep on the suspect's system, it will be buried 10 folders deep within the Target Destination folder.
RecreateDirectories: true # Required, true means the folder structure of the artifacts will be created within the user-specified Target Destination directory. If an artifact is buried 10 folders deep on the suspect's system, it will be buried 10 folders deep within the Target Destination folder.
Targets:
-
Name: CompoundTarget1 # Required
Expand Down
2 changes: 1 addition & 1 deletion Targets/CompoundTargetTemplate.template
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Description: Name of application/artifact here # Required
Author: Your name here # Required
Version: 1.0 # Required
Id: Unique GUID here # Required
RecreateDirectories: True # Required
RecreateDirectories: true # Required
Targets:
-
Name: CompoundTarget1 # Required
Expand Down
6 changes: 3 additions & 3 deletions Targets/TargetGuide.guide
Original file line number Diff line number Diff line change
Expand Up @@ -3,15 +3,15 @@ Description: Name of application/artifact here # Required, this will be visible
Author: Your name here # Required
Version: 1.0 # Required, increment as Target is revised.
Id: Unique GUID here # Required, generate within gKape by double clicking on a Target or Module, then click Generate GUID button at bottom of popup window, paste GUID here.
RecreateDirectories: True # Required, true means the folder structure of the artifacts will be created within the user-specified Target Destination directory. If an artifact is buried 10 folders deep on the suspect's system, it will be buried 10 folders deep within the Target Destination folder.
RecreateDirectories: true # Required, true means the folder structure of the artifacts will be created within the user-specified Target Destination directory. If an artifact is buried 10 folders deep on the suspect's system, it will be buried 10 folders deep within the Target Destination folder.
Targets:
-
Name: Artifact name here # Required
Category: Category goes here # Required, if your Target is related to other pre-existing Targets, it's recommended to use that same Category for your Target.
Path: C:\Users\%user%\AppData\*\Microsoft\ # Required, notice the %user% variable is in place telling KAPE to search every user folder on the system. * can be used as wildcards for folder or file names that are unpredictable/unique.
Recursive: True # Optional, if missing, it will default to false.
Recursive: true # Optional, if missing, it will default to false.
FileMask: "desktop.ini" # Optional, other examples include SOFTWARE.logX (for those .log1, .log2, etc files), *_logs.txt (for those logs that are prepended with a timestamp, for instance), log*.txt (for log files that are named as log1, log2, etc), *.txt (for all .txt files regardless of filename), and filename.* (for all files with a filename of "filename", regardless of file extension) to name a few. When in doubt, test your Target on your own sample data to confirm it works.
AlwaysAddToQueue: True # Optional, this setting it mostly used for files that are actively in use by the system at the time of acquisition, i.e. MFT, etc. True means it'll defer grabbing the file until the other Targets run. In most cases, do not use this. Please read the KapeDocs documentation prior to using this.
AlwaysAddToQueue: true # Optional, this setting it mostly used for files that are actively in use by the system at the time of acquisition, i.e. MFT, etc. true means it'll defer grabbing the file until the other Targets run. In most cases, do not use this. Please read the KapeDocs documentation prior to using this.
SaveAsFileName: output.csv # Optional, but can be used if needed.
MinSize: 1000 # Optional, in bytes.
MaxSize: 10000 # Optional, in bytes.
Expand Down
6 changes: 3 additions & 3 deletions Targets/TargetTemplate.template
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,15 @@ Description: Name of application/artifact here # Required
Author: Your name here # Required
Version: 1.0 # Required
Id: Unique GUID here # Required
RecreateDirectories: True # Required
RecreateDirectories: true # Required
Targets:
-
Name: Artifact name here # Required
Category: Category goes here # Required
Path: C:\ # Required
Recursive: True # Optional
Recursive: true # Optional
FileMask: "filename.ext" # Optional
AlwaysAddToQueue: True # Optional
AlwaysAddToQueue: true # Optional
SaveAsFileName: output.csv # Optional
MinSize: 1000 # Optional
MaxSize: 10000 # Optional
Expand Down
2 changes: 1 addition & 1 deletion Targets/Windows/SnipAndSketch.tkape
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ Description: Snip & Sketch Cached Images
Author: Kevin Pagano
Version: 1.0
Id: b881c3bb-58b1-4e63-be1a-8159794e5a4b
RecreateDirectories: True
RecreateDirectories: true
Targets:
-
Name: Snip & Sketch
Expand Down

0 comments on commit 4e56081

Please sign in to comment.