Forensic Sorting Tools
Windows Registry
requires the
SAM
,SOFTWARE
,SYSTEM
andNTUSER.DAT
registry files.doesn't process the registry files of the running operating system.
shows information about (Windows 2000 or higher).
the operating system.
installed software.
the last user activity.
the user settings.
and many other details.
the amount of information for each category can be configured in the settings dialog.
it allows you to save, print, and search the generated report.
requires the
SAM
,SOFTWARE
, andSYSTEM
files.extracts the following information:
RID, Login Name, Name, Description, User Comment
LM Hash, NT Hash.
Last Login Date, Password Reset Date, Account Expiry Date, Login Fail Date.
Login Count, Failed Logins, Profile Path, Groups.
For crashed machines, registry configuration, and data recovery.
It allows us to explore:
File information
SAM
Security Record Explorer
Windows Installation
Hardware
User Data
Startup Applications
Services and Drivers
Network Configuration
Windows Firewall Settings
Environment
Shell Folders
Outlook Express
Raw Data
Free software program for finding files on your PC or network drives.
Fast search (less time waiting).
Powerful search capabilities (Boolean expressions, Perl regex).
Supports Microsoft Office and Libre Office file formats.
Portable Applications
Collection of freeware tools, such as:
DataProtectionDecryptor – decrypts passwords of Microsoft Outlook accounts, credentials files of Windows, wireless network keys, passwords in some versions of Internet Explorer, passwords, and cookies of Chrome Web browser.
JumpListsView – displays the information stored by the ’Jump Lists’.
Windows File Analyzer – decodes and analyzes to provide cached information.
BinText – extracts strings from binary files.
Data Converter – converts numbers, hexadecimal values, or dates.
EXIF Viewer – displays EXIF information from JPEG images.
eMule MET Viewer – shows various information from the eMule...
Multi-Purpose Tool
Very powerful and user-friendly tool:
Runs as a portable application, ideal to include in WinFE.
Search files.
Look for deleted files.
Copy files (e.g. cache and registry files).
Identify ADS (Alternate Data Stream).
Acquire storage devices and RAM.
Mount
E01
files.
Last updated