NTDS.dit (Microsoft Active Directory) forensics module for Powershell.
Find it on Github here.
Current bug: Unencrypted NT hashes are incorrect!
This Powershell module is intended to aid in the process of examining and extracting information from the Active Directory database known as NTDS.dit.
Special thanks to Csaba Barta (email@example.com, www.ntdsxtract.com) without whom this module would not be possible.
Also thanks to @moyix, moyix.blogspot.com, firstname.lastname@example.org
Also thanks to Brendan Dolan-Gavitt, author of creddump
Q: So why did I reinvent the wheel?
Python shouldn't have all the fun. I wanted to port the ideas into idiomatic Powershell.
I wanted to gain in-depth knowledge of the subject for myself, not just run someone else's scripts.
I have further plans with this data and it will be very handy to have it in Powershell format.
Currently exported Cmdlets:
A couple of screenshots: