The scripts below are to be used for Windows NT 4.0, Windows 2000, and Windows Server 2003.T he Windows Server 2003 scripts and executables work for Windows XP.
These scripts enable a responder to compile volatile information from a Windows system before taking the system off line. Incident responders can use the information generated from these scripts to determine if an incident occurred and determine the next best course of action.
The executables referenced in the scripts are all readily available via the OS, Internet, and/or Feature Packs. They will not be provided here.
Make sure to test these scripts in a development environment before rolling out to production.
I am working on an updated version that adds a menu and supports Windows 7 / Windows 2008.