Readme.md

Windows Diagnostics Infrastructure

Path: "\Windows\System32\WDI"

• WDI.ps1 - Powershell script that uses Microsoft TraceRpt.Exe to convert all Event Trace Logs (.ETL) of the target "\Windows\System32\WDI" folder to the respective summary.txt and eventlog.csv (comma separated file). It also copies the StartupInfo folder and it's contents. Target output folder is the user's 'Desktop\WDI_currentdatetime'.

  • Sample images:

    Source of the test image file: LoneWolf.E01 Scenario
    

    Snapshot.etl
    

    

    S-1-5-21-2734969515-1644526556-1039763013-1001_StartupInfo3.xml
    

    

    Logfiles\StartupInfo contents from the same image file as above
    Each has the Startup tasks & processes (Run/RunOnce, etc) per user (SID filename)