libyal / winreg-kbLinks
Windows Registry Knowledge Base
☆180Updated 10 months ago
Alternatives and similar repositories for winreg-kb
Users that are interested in winreg-kb are comparing it to the libraries listed below
Sorting:
- $MFT directory tree reconstruction & FILE record info☆310Updated 10 months ago
- AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10☆122Updated 7 months ago
- Command line access to the Registry☆153Updated last month
- ☆149Updated last year
- ☆68Updated last week
- Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10.☆114Updated 7 months ago
- An NTFS/FAT parser for digital forensics & incident response☆208Updated 9 months ago
- Windows 10 (v1803+) ActivitiesCache.db parsers (SQLite, PowerShell, .EXE)☆189Updated 2 years ago
- Parser for $LogFile on NTFS☆202Updated 2 months ago
- Parses $MFT from NTFS file systems☆256Updated 3 months ago
- C# based evtx parser with lots of extras☆318Updated last month
- MFT parser☆68Updated 6 months ago
- Win 10/11 related research☆191Updated last year
- Carve file metadata from NTFS index ($I30) attributes☆70Updated last year
- Parser for $UsnJrnl on NTFS☆114Updated 2 years ago
- Library and tools to access the Windows Prefetch File (SCCA) format.☆78Updated 7 months ago
- Event Tracing For Windows (ETW) Resources☆395Updated 10 months ago
- Script for parsing Symantec Endpoint Protection logs, VBNs, and ccSubSDK database.☆65Updated 2 years ago
- Parses amcache.hve files, but with a twist!☆140Updated 7 months ago
- Prefetch Explorer Command Line☆261Updated 7 months ago
- A collection of free miscellaneous Windows tools☆137Updated last month
- Regipy is an os independent python library for parsing offline registry hives☆259Updated 2 months ago
- A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of eve…☆46Updated 2 years ago
- Detection in the form of Yara, Snort and ClamAV signatures.☆237Updated 9 months ago
- Encyclopedia for Executables☆449Updated 3 years ago
- SysmonX - An Augmented Drop-In Replacement of Sysmon☆216Updated 5 years ago
- An AFF4 C++ implementation.☆206Updated 2 years ago
- A guide on how to write fast and memory friendly YARA rules☆151Updated 6 months ago
- A repo that contains recursive directory listings (using PowerShell) of a vanilla (clean) install of every Windows OS version to compare …☆172Updated 9 months ago
- Tool suite for inspecting NTFS artifacts.☆224Updated last year