Old School MS-DOS Commands for DFIR

In this episode, we'll look at numerous old-school MS-DOS commands from the 80's and 90's that are still very valid and useful today -- even in Windows 11! Learn how to perform complex file searches, change file attributes, view Alternate Data Streams, and more - right from the Command Prompt!

** If you enjoy this video, please consider supporting 13Cubed on Patreon at patreon.com/13cubed. **

📖 Chapters

00:00 - Intro
02:15 - DIR
03:01 - CLS
03:55 - DIR /A
05:07 - DIR /AH
05:47 - DIR /AD
07:21 - DIR /OD
08:12 - DIR /TC
08:34 - DIR /A/TC/OD
09:26 - DIR /W
10:10 - DIR /S [FILENAME]
11:40 - DIR /S/A [FILENAME]
13:16 - DIR /S/A ?.EXE
14:16 - DIR /S/A ??.EXE
15:11 - DIR /P
16:17 - DIR /S/A [PATTERN]*.??
17:49 - DIR /S/AH ?.EXE
18:52 - CD | CHDIR
20:25 - DIR /R
20:44 - DIR /R/A
21:25 - MORE [LESS THAN] [ADS]
22:34 - ATTRIB
24:58 - COPY [SOURCE] [DESTINATION]
25:52 - MOVE [SOURCE] [DESTINATION]
27:09 - MD | MKDIR [DIRECTORY]
27:41 - COPY CON [FILENAME]
28:38 - TYPE [FILENAME]
30:00 - RD | RMDIR [DIRECTORY]
30:52 - RD | RMDIR /S [DIRECTORY]
31:26 - DEL | ERASE [FILENAME]
32:27 - REN | RENAME [OLD] [NEW]

#Forensics #DigitalForensics #DFIR #ComputerForensics #WindowsForensics