# Application artifacts.
---
name: GnomeEvolution
doc: Gnome Evolution files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/.cache/evolution/**'
    - '%%users.homedir%%/.config/evolution/**'
    - '%%users.homedir%%/.local/share/evolution/**'
supported_os: [Linux]
---
name: MicrosoftOfficeAutosave
aliases: [WindowsMsOfficeAutosave]
doc: Automatically created Microsoft Office recovery files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.appdata%%\Microsoft\Word\**'
    - '%%users.appdata%%\Microsoft\Excel\**'
    - '%%users.appdata%%\Microsoft\Powerpoint\**'
    - '%%users.appdata%%\Microsoft\Publisher\**'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/windows#microsoft-office-autosave']
---
name: MicrosoftOfficeMRU
doc: Microsoft Office Most Recently Used
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.homedir%%/Library/Preferences/com.microsoft.office.plist'
    - '%%users.homedir%%/Library/Containers/com.microsoft.*/Data/Library/Preferences/com.microsoft.*.securebookmarks.plist'
    separator: '/'
  supported_os: [Darwin]
- type: REGISTRY_VALUE
  attributes:
    key_value_pairs:
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Office\*\*\File MRU', value: 'Item *'}
    - {key: 'HKEY_USERS\%%users.sid%%\Software\Microsoft\Office\*\*\Place MRU', value: 'Item *'}
  supported_os: [Windows]
supported_os: [Darwin, Windows]
urls: ['https://github.com/mac4n6/macMRU-Parser']
---
name: MicrosoftOutlookPABFiles
doc: Microsoft Outlook PAB Files
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Microsoft\Outlook\*.pab'
    - '%%users.userprofile%%\Documents\Outlook Files\*.pab'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)']
---
name: MicrosoftOutlookPSTFiles
doc: Microsoft Outlook PST Files
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Microsoft\Outlook\*.pst'
    - '%%users.userprofile%%\Documents\Outlook Files\*.pst'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)']
---
name: MicrosoftOutlookOSTFiles
doc: Microsoft Outlook OST Files
sources:
- type: FILE
  attributes:
    paths:
    - '%%users.localappdata%%\Microsoft\Outlook\*.ost'
    - '%%users.userprofile%%\Documents\Outlook Files\*.ost'
    separator: '\'
supported_os: [Windows]
urls: ['https://forensics.wiki/personal_folder_file_(pab,_pst,_ost)']
---
name: NodeJSPackageManagerCacheFiles
doc: Node JS package manager (NPM) cache files
sources:
- type: FILE
  attributes:
    paths: ['%%users.homedir%%/.npm/*']
  supported_os: [Darwin, Linux]
- type: FILE
  attributes:
    paths: ['%%users.appdata%%\npm-cache\*']
    separator: '\'
  supported_os: [Windows]
supported_os: [Darwin, Linux, Windows]
urls: ['https://docs.npmjs.com/cli/cache']
---
name: WinRARExternalViewer
doc: Executable run when a file is opened by WinRAR inside an archive.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\WinRAR\Viewer\', value: 'ExternalViewer'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/'
- 'http://acritum.com/software/manuals/winrar/html/helpinterfaceviewing.htm'
---
name: WinRARAVScan
doc: Executable run to scan a file when it is opened by WinRAR.
sources:
- type: REGISTRY_VALUE
  attributes: {key_value_pairs: [{key: 'HKEY_USERS\%%users.sid%%\Software\WinRAR\VirusScan\', value: 'Name'}]}
supported_os: [Windows]
urls:
- 'http://www.hexacorn.com/blog/2012/09/16/beyond-good-ol-run-key-part-2/'
- 'http://acritum.com/software/manuals/winrar/html/helpcommandsvirusscan.htm'
---
name: MicrosoftSqlServerErrorLogs
doc: Microsoft SQL Server's error log files.
sources:
- type: FILE
  attributes:
    paths:
    - '%%environ_programfiles%%\Microsoft SQL Server\*\MSSQL\LOG\ERRORLOG*'
    - '%%environ_programfilesx86%%\Microsoft SQL Server\*\MSSQL\LOG\ERRORLOG*'
    separator: '\'
supported_os: [Windows]
---
name: MozillaThunderbird
doc: Mozilla Thunderbird files.
sources:
- type: FILE
  attributes: {paths: ['%%users.homedir%%/.thunderbird/**']}
supported_os: [Linux]
