# Bergsson Windows tools — 1.0.0

Two portable Windows x64 desktop apps, built from the C# source in this folder.
Both use .NET Framework 4.8 and Windows Forms. Python, Node.js and an account are
not required to run them. Windows 10/11 x64 are the intended platforms.

## Collection Tool

1. Enter a case name and optional examiner name.
2. Choose a writable output folder, preferably on a separate collection drive.
3. Select only the modules agreed for the investigation. Selecting a row shows
   its exact scope and limitations. The default is system, processes and network.
4. If collecting game logs, choose the active game instance folder.
5. Confirm permission, then Start collection. Some sources need you to close the
   app and choose Windows 'Run as administrator'. Elevation is never automatic.
6. Open report.html. Review failed, partial, unavailable and changed-source items.

Output: a fresh case folder, manifest.json, collection-plan.json, collection.log,
raw copied files / native EVTX / logical command output, report.html and
SHA256SUMS.txt. Optional ZIP and a SHA-256 sidecar are saved beside the case folder.
The checksum list covers every case file except itself. The archive sidecar hashes
the final ZIP. Files listed as partial are evidence of an incomplete collection.

Sixteen modules: system/clock, running processes, network, Prefetch, PCA, event
logs, Security log, selected registry keys, shortcuts/Jump Lists, current-user
Recycle Bin metadata, startup configuration, PowerShell, Amcache, SRUM, USN and
selected game logs/binary hash inventory. Browsers, credentials and RAM are not
acquired. No data is uploaded. Running the app creates normal live-system traces.

Important limits:
- This is live logical triage, not a disk image or complete forensic acquisition.
- The process snapshot reflects visible processes at that moment. Where WMI is
  unavailable a fallback omits parent PIDs and command lines, and reports the gap.
- Registry .reg exports do not preserve key LastWrite timestamps or transaction
  logs. Locked Amcache and SRUM copies can fail. SRUM live copies may be inconsistent.
- EVTX exports use the previous seven days; channels can be absent or denied.
- USN reads the recent 32 MiB journal address range at collection start, capped at
  100,000 records / 60 seconds. It supports V2/V3 and records gaps/unsupported
  formats. CSV is a logical sample. usn-api-buffers.bin is a documented API-buffer
  container, not a raw $J file for MFTECmd. Parent references are not full paths.
- Standard copies are capped at 100 MiB each, 5,000 considered copied files and
  2 GiB total copied data. Game logs: 20 MiB each; binary hashes: 100 MiB each;
  2,000 considered files and eight directory levels. Reparse points are skipped.
- The app logs collection actions. It never clears logs, changes auditing,
  enables/disables journals, stops services or removes source records.
- Stop cancels collection reads/commands and retains partial results. Final
  checksums/reporting and ZIP creation can take longer; wait before closing.

## Download Tool

Choose a folder and tools or a preset. A new timestamped toolkit folder is created
each run. Nineteen packages are linked to their official Microsoft Sysinternals or
Eric Zimmerman publishers, checked on 28 October 2026. Links can change later.

Original ZIPs remain in archives/, extracted files in tools/. Download manifests,
SHA-256 inventories and an offline HTML report are included. The app never runs
third-party programs, installs them, accepts their licences or disables security.

Downloads use HTTPS and a publisher-host allowlist, validated redirects, size
limits and bounded retries. ZIP traversal, links and oversized archives are
rejected. A failed package does not hide or prevent the other results.
Windows Authenticode trust is checked for EXE/DLL files offline; revocation is not
checked. An unverified signature is explicitly flagged. Computed hashes record
what arrived; these are not independently compared with publisher-provided hashes.

Most selected Zimmerman CLI tools use .NET Framework 4.7.2+. AmcacheParser and
Timeline Explorer need .NET 10 (Desktop Runtime for GUI tools), available from
https://dotnet.microsoft.com/download/dotnet/10.0 . Read each publisher's licence
and documentation before running it. Third-party binaries are downloaded directly
from publishers rather than redistributed inside the Bergsson apps.

## Build and checks

Run `powershell -File tools/windows/build.ps1` from the project root. It uses the
Windows .NET Framework C# compiler and writes the two executables to public/downloads.
Common.cs provides UI, hashing, bounded commands and extraction. Collection.cs and
Usn.cs implement local collection. Download.cs and catalog.json implement downloads.
The embedded logo and icon belong to Bergsson.

The source ZIP is also self-contained: extract it to a folder and run its build.ps1;
the executables are then written to dist/.

Both apps support `--self-test FOLDER` and `--preview PNG_FILE` for isolated
verification. Collection supports `--collect CONFIG_JSON` with CaseId, Examiner,
Output, GameFolder, Modules (array of module IDs), and Zip. Download supports
`--download OUTPUT_FOLDER strings,pecmd` for a chosen publisher download check.
Use these explicit modes only on agreed test fixtures or authorised systems.

Release binaries are unsigned because no publisher code-signing certificate is
configured. Windows may show an unknown-publisher/SmartScreen prompt. Do not
switch off Windows security. Compare SHA-256 with the download page and inspect
the source if needed. Signing and testing across more Windows builds are separate
release steps; elevated collection sources need validation on an approved test PC.

Sources:
https://learn.microsoft.com/windows-server/administration/windows-commands/wevtutil
https://learn.microsoft.com/windows/win32/api/winioctl/ni-winioctl-fsctl_read_usn_journal
https://learn.microsoft.com/windows/win32/api/winioctl/ns-winioctl-read_usn_journal_data_v0
https://learn.microsoft.com/sysinternals/downloads/
https://ericzimmerman.github.io/