anchor.diff:    Ideally forensicswiki.org links.
   
   
  -Long docs
  ----------
  +== Long docs
   
   Multi-line docs should use the Literal Style indicated by the |
   character with a double newline between the short description and the longer
   portion.  Explicit newlines (\n) should not be used:
   
  ---------------------------------------------------------------------------------
  +[source,yaml]
  +----
   doc: |
     Collect windows run keys.
   
     Note users.sid will currently only expand to SIDs with profiles on the system,
     not all SIDs.
  ---------------------------------------------------------------------------------
  -
  -Collectors
  -----------
  +----
  +
  +== Collectors
   
   The available collector types are defined in
   link:https://github.com/ForensicArtifacts/artifacts/blob/master/artifacts/definitions.py[definitions.py]
  
positive.code: Since OS conditions are a very common constraint, this has been provided as a
  separate option "supported_os" to simplify syntax.  Under the hood, this:
  
  --------------------------------------------------------------------------------
  supported_os: [Windows, Linux, Darwin]
  --------------------------------------------------------------------------------
  
  is translated to objectfilter as:
  
  --------------------------------------------------------------------------------
  ["os =='Windows'" OR "os=='Linux'" OR "os == 'Darwin'"]
  --------------------------------------------------------------------------------
  
  supported_os should be used when specifying os conditions, no quotes are
  required.  Single quotes should be used for strings when writing conditions.
  
  --------------------------------------------------------------------------------
  conditions: [os_major_version >= 6 and time_zone == 'America/Los_Angeles']
  --------------------------------------------------------------------------------
  
  Minimize the Number of Definitions by Using Multiple Collectors
  ---------------------------------------------------------------
  
  To minimize the number of artifacts in the list, combine them using the
  supported_os and conditions attributes where it makes sense. e.g. rather than
  having FirefoxHistoryWindows, FirefoxHistoryLinux, FirefoxHistoryDarwin, do:
  
  --------------------------------------------------------------------------------
  name: FirefoxHistory
  doc: Firefox places.sqlite files.
  collectors:
  
negative.code: = Artifact YAML Style Guide
  
  :toc:
  :toc-placement: preamble
  :icons:
  
  [NOTE]
  This style guide aims to ensure consistency and readbility for forensics
  artifacts defined in link:http://www.yaml.org/spec/1.2/spec.html[YAML].
  The format is currently under development and might undergo some
  change. Eventually this style should be enforced in code.
  
  == The Basics
  
  Here's a typical artifact definition:
  
  [source,yaml]
  ----
  name: ApplicationEventLogEvtx
  doc: Windows Application Event Log for Vista or newer systems.
  collectors:
  