williballenthin / wevt_template
extract and parse WEVT_TEMPLATEs from PE files
☆17Updated 8 months ago
Related projects: ⓘ
- Parse Microsoft shim databases☆28Updated 2 weeks ago
- Extension blocks as found in ShellBags and other places in the Registry☆23Updated 2 weeks ago
- Tools for macOS Forensic Bootable media☆15Updated 4 years ago
- This is a repository for reporting any issues in any of my software☆11Updated 6 years ago
- $MFT parser (from live systems or a copy of the $MFT) and raw file copy utility☆36Updated 2 months ago
- Analysis and manipulation of extended attribute ($EA) on NTFS☆38Updated 9 years ago
- ☆59Updated 2 months ago
- Mount VSCs with ease!☆14Updated last year
- Library to process OLE compound file format. This is a work in progress and was initially written for jumplist parsing (for which it does…☆18Updated 2 weeks ago
- CLI tool to compute the TypeRefHash for .NET binaries.☆20Updated 2 years ago
- An efficient tool for extracting files, directories, and alternate data streams directly from NTFS image files.☆17Updated 6 months ago
- Wrapper for TSK (Sleuth Kit) Bindings☆11Updated last year
- Lnk file parser☆78Updated 2 weeks ago
- MFT parser☆58Updated 6 months ago
- All TMF files that I extracted from Microsoft PDBs.☆12Updated 5 years ago
- NTFS samples☆24Updated 4 years ago
- A repo that contains a recursive dump from the ROOT key of every Windows Registry hive (using KAPE) from a vanilla (clean) install of eve…☆44Updated last year
- Windows registry samples☆23Updated 5 years ago
- Manage Your Large Team of Consultants☆12Updated last month
- USN to JSON☆22Updated 4 years ago
- An efficient tool for search files, directories, and alternate data streams directly from NTFS image files.☆19Updated 6 months ago
- Automatic/Custom Destinations & LNK (MS-SHLLINK) Browser☆30Updated 6 months ago
- Registry Explorer bookmark definitions☆41Updated last year
- Support Windows OS Reversing by searching easily for references to functions across many DLLs☆33Updated 2 years ago
- lnk_parser is a full rust implementation to parse windows LNK files☆16Updated last year
- Library and tools to access the Windows Prefetch File (SCCA) format.☆70Updated 3 weeks ago
- Parses the WMI object database....looking for persistence☆31Updated 4 years ago
- An experimental dynamic malware unpacker based on Intel Pin and PE-sieve☆57Updated 3 weeks ago
- A Microsoft Windows service to provide telemetry on Windows executable memory page changes to facilitate threat detection☆28Updated 3 years ago
- ☆15Updated 2 weeks ago