kacos2000 / WindowsTimeline
Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)
☆183Updated 2 years ago
Alternatives and similar repositories for WindowsTimeline:
Users that are interested in WindowsTimeline are comparing it to the libraries listed below
- Command line access to the Registry☆138Updated 2 months ago
- AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10☆116Updated 2 months ago
- This is a set of tools for doing forensics analysis on Microsoft ESE databases.☆124Updated 3 years ago
- Invoke-LiveResponse☆147Updated 3 years ago
- Yet another registry parser☆132Updated 2 years ago
- Extract BITS jobs from QMGR queue and store them as CSV records☆75Updated last month
- Stand-alone parser for User Access Logging from Server 2012 and newer systems☆72Updated last year
- The Office 365 Extractor is a tool that allows for complete and reliable extraction of the Unified Audit Log (UAL)☆159Updated 2 years ago
- A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare …☆155Updated 4 months ago
- C# based evtx parser with lots of extras☆296Updated 2 weeks ago
- Documentation repository☆44Updated 7 months ago
- A modern Python-3-based alternative to RegRipper☆193Updated 4 months ago
- A parser of Windows Defender's DetectionHistory forensic artifact, containing substantial info about quarantined files and executables.☆113Updated 3 years ago
- A series of scripts☆98Updated 3 years ago
- Parser for Windows PowerShell script block logs☆95Updated 7 months ago
- A script that updates KAPE (using Get-KAPEUpdate.ps1) as well as EZ Tools (within .\KAPE\Modules\bin) and the ancillary files that enhanc…☆55Updated 2 months ago
- Digital Forensics Artifacts Knowledge Base☆80Updated 10 months ago
- ☆302Updated 4 years ago
- ATT&CK Remote Threat Hunting Incident Response☆200Updated 3 months ago
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆64Updated 2 years ago
- Useful access control entries (ACE) on system access control list (SACL) of securable objects to find potential adversarial activity☆90Updated 3 years ago
- Dump of organized knowledge on DFIR☆134Updated 3 years ago
- "Evolving AppCompat/AmCache data analysis beyond grep"☆201Updated 3 years ago
- Extract common Windows artifacts from source images and VSCs☆65Updated 3 years ago
- Memory Baseliner is a script that can compare two windows memory images or perform frequency of occurrence / data stacking analysis on mu…☆52Updated last year
- Get all my software☆153Updated 2 months ago
- ☆64Updated 3 weeks ago
- An NTFS/FAT parser for digital forensics & incident response☆200Updated 4 months ago
- OneDriveExplorer is a command line and GUI based application for reconstructing the folder structure of OneDrive from the <UserCid>.dat a…☆194Updated last month
- Parses amcache.hve files, but with a twist!☆130Updated 2 months ago