libyal / esedb-kbLinks
Extensible Storage Engine (ESE) Database File Knowledge Base
☆45Updated last month
Alternatives and similar repositories for esedb-kb
Users that are interested in esedb-kb are comparing it to the libraries listed below
Sorting:
- A PowerShell module to assist in parsing and managing catalog files.☆22Updated 9 years ago
- Windows Registry Knowledge Base☆195Updated last month
- ☆18Updated 12 years ago
- Event metadata collected across all manifest-based ETW providers on Window 10 1903☆31Updated 6 years ago
- Registry Explorer bookmark definitions☆44Updated last year
- Parses the WMI object database....looking for persistence☆34Updated 6 years ago
- Windows registry samples☆24Updated 7 years ago
- ☆76Updated last week
- Library and tools to access the Windows Prefetch File (SCCA) format.☆83Updated last month
- Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.☆116Updated last year
- Decode security descriptors in $Secure on NTFS☆22Updated 3 years ago
- SysInternals' Process Monitor filters repository - collected from various places and made up by myself. To be used for quick Behavioral a…☆70Updated 4 years ago
- Binary commandline executable to parse ETL files☆69Updated 7 years ago
- Parse Microsoft shim databases☆32Updated last year
- Repository containing malware analysis filters for the Windows SysInternals' - Process Monitor tool☆20Updated 5 years ago
- Yet another registry parser☆138Updated 3 years ago
- PowerSponse is a PowerShell module focused on targeted containment and remediation during incident response.☆40Updated 3 years ago
- $MFT parser (from live systems or a copy of the $MFT) and raw file copy utility☆38Updated last year
- Extension blocks as found in ShellBags and other places in the Registry☆25Updated last year
- Active Directory Group Policy analyzer☆108Updated 11 years ago
- Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)☆196Updated 2 years ago
- A collection of Windows software baseline notes with corresponding Windows Defender Application Control (WDAC) policies☆64Updated 2 years ago
- An NTFS journal parser☆80Updated 9 years ago
- An Incident Response tool that visualizes historic process execution evidence (based on Event ID 4688 - Process Creation Event) in a tree…☆60Updated 8 years ago
- Lnk file parser☆91Updated 8 months ago
- Scripts and tools created for appx analysis talk (Magnet summit 2019)☆19Updated last year
- Library and tools to access the Microsoft Internet Explorer (MSIE) Cache File (index.dat) files☆16Updated last month
- Trace ScriptBlock execution for powershell v2☆40Updated 6 years ago
- PowerShell scripts for Hard Drive forensics and parsing Windows Artifacts☆56Updated 5 years ago
- NTFS samples☆27Updated 5 years ago