Форензика и OSINT

# import re
# with open("C:/Users/Mason/Desktop/python/Python/Search/access_log-20180813","r") as file:  #Путь к логу который должен находится в одном каталоге с скриптом
#     text = file.read()
# Ips=re.findall(r'[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}',text)
# file_with_ip=open("C:/___/____/_____/access_log-2018-ip.txt","a")    #Файл с результатом выполнения
# file_with_ip.write("\n".join(set(Ips)))

SELECT datetime(last_visit_time / 1000000 + (strftime('%s', '1601-01-01')), 'unixepoch','localtime') AS [Дата],
    url AS [URL], title AS [Сайт], visit_count AS [Количество посещений]
FROM urls
ORDER BY last_visit_time DESC

datetime(last_visit_time / 1000000 + (strftime('%s', '1601-01-01')), 'unixepoch','localtime')

$date = Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\' | select -ExpandProperty InstallDate
(Get-Date "1970-01-01 00:00:00.000Z") + ([TimeSpan]::FromSeconds($date))

c:\Users\{user}\AppData\Local\Microsoft\Terminal Server Client\Cache\