EricZimmerman / AppCompatCacheParser
AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10
☆117Updated 3 months ago
Alternatives and similar repositories for AppCompatCacheParser:
Users that are interested in AppCompatCacheParser are comparing it to the libraries listed below
- Parses amcache.hve files, but with a twist!☆132Updated 3 months ago
- Parses RecentFileCacheParser.bcf files☆28Updated 2 months ago
- Command line access to the Registry☆142Updated 3 weeks ago
- ☆66Updated last month
- MFT parser☆65Updated 2 months ago
- Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.☆112Updated 3 months ago
- C# based evtx parser with lots of extras☆300Updated this week
- Prefetch Explorer Command Line☆251Updated 3 months ago
- Lnk Explorer Command line edition!!☆298Updated 3 months ago
- Recycle bin artifact parser☆47Updated 2 months ago
- A repository that maps API calls to Sysmon Event ID's.☆119Updated 2 years ago
- ☆302Updated 4 years ago
- ☆19Updated 2 months ago
- Cobalt Strike Beacon configuration extractor and parser.☆152Updated 3 years ago
- YARA rule analyzer to improve rule quality and performance☆98Updated 2 weeks ago
- Windows Registry Knowledge Base☆173Updated 6 months ago
- OneDriveExplorer is a command line and GUI based application for reconstructing the folder structure of OneDrive from the <UserCid>.dat a…☆194Updated 2 months ago
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆52Updated last year
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆64Updated 2 years ago
- $MFT directory tree reconstruction & FILE record info☆304Updated 6 months ago
- Parser for $UsnJrnl on NTFS☆110Updated 2 years ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆113Updated 3 years ago
- ☆51Updated last month
- Carve file metadata from NTFS index ($I30) attributes☆63Updated last year
- Dump quarantined files from Windows Defender☆62Updated 3 years ago
- ☆40Updated 3 months ago
- Documentation repository☆44Updated 7 months ago
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆73Updated last year
- ☆68Updated 2 months ago
- Parser for $LogFile on NTFS☆193Updated last year