Forensic Sorting Tools

Windows Registry

RegistryReport

• requires the SAM, SOFTWARE, SYSTEM and NTUSER.DAT registry files.

• doesn't process the registry files of the running operating system.

• shows information about (Windows 2000 or higher).

  • the operating system.

  • installed software.

  • the last user activity.

  • the user settings.

  • and many other details.

• the amount of information for each category can be configured in the settings dialog.

• it allows you to save, print, and search the generated report.

ForensicUserInfo

• requires the SAM, SOFTWARE, and SYSTEM files.

• extracts the following information:

  • RID, Login Name, Name, Description, User Comment

  • LM Hash, NT Hash.

  • Last Login Date, Password Reset Date, Account Expiry Date, Login Fail Date.

  • Login Count, Failed Logins, Profile Path, Groups.

Mitec WRR (Windows Registry Recovery)

For crashed machines, registry configuration, and data recovery.

It allows us to explore:

• File information

• SAM

• Security Record Explorer

• Windows Installation

• Hardware

• User Data

• Startup Applications

• Services and Drivers

• Network Configuration

• Windows Firewall Settings

• Environment

• Shell Folders

• Outlook Express

• Raw Data

RanSack

Free software program for finding files on your PC or network drives.

• Fast search (less time waiting).

• Powerful search capabilities (Boolean expressions, Perl regex).

• Supports Microsoft Office and Libre Office file formats.

Portable Applications

Collection of freeware tools, such as:

• DataProtectionDecryptor – decrypts passwords of Microsoft Outlook accounts, credentials files of Windows, wireless network keys, passwords in some versions of Internet Explorer, passwords, and cookies of Chrome Web browser.

• JumpListsView – displays the information stored by the ’Jump Lists’.

• Windows File Analyzer – decodes and analyzes to provide cached information.

• BinText – extracts strings from binary files.

• Data Converter – converts numbers, hexadecimal values, or dates.

• EXIF Viewer – displays EXIF information from JPEG images.

• eMule MET Viewer – shows various information from the eMule...

Multi-Purpose Tool

FTK Imager

Very powerful and user-friendly tool:

• Runs as a portable application, ideal to include in WinFE.

• Search files.

• Look for deleted files.

• Copy files (e.g. cache and registry files).

• Identify ADS (Alternate Data Stream).

• Acquire storage devices and RAM.

• Mount E01 files.