Event Log Explorer

Description

Event Log Explorer is an effective software solution for viewing, analyzing and monitoring events recorded in Microsoft Windows event logs. Event Log Explorer greatly simplifies and speeds up the analysis of event logs (security, application, system, setup, directory service, DNS and others).

Platform	Windows
Author	FSPro Labs
License	Free for Home Use
URL	https://www.eventlogxp.com/

Usage

Examples

Blog Posts

ShellBags Explorer

Description

Parses BagMRU keys from online or offline registry hives and displays them in an Explorer like interface.

Platform	Windows
Author	Eric Zimmerman
License	MIT License
URL	https://ericzimmerman.github.io/#!index.md

Usage

SBECmd version 1.4.0.0
 
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman
 
        d               Directory to look for registry hives. This or -l is required
        l               Process live registry. This or -d is required
        csv             Directory to save output to. Required
 
        dedupe          When true, SBECmd processes all hives in -d <directory> and removes duplicates. See manual for details
 
        dt              Date/time format string to use. Default is 'yyyy-MM-dd HH:mm:ss'
        tz              Time zone to use (Default = UTC). Enclose in quotes. Use '--tz list' for options
        nl              When true, ignore transaction log files for dirty hives. Default is FALSE
 
Examples: SBECmd.exe -d c:\temp\hives --csv c:\temp\sbeout
          SBECmd.exe -d c:\temp\hives --csv c:\temp\sbeout --tz "US Eastern Standard Time"
          SBECmd.exe -d c:\temp\hives --csv c:\temp\sbeout --dedupe
 
          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

Examples

Blog Posts

RegRipper

Description

The Registry Ripper, or RegRipper, is an open-source application for extracting, correlating, and displaying information from Windows NT registry hive files.

Platform	Perl
Author	H. Carvey
License	GPLv3
URL	https://github.com/warewolf/regripper

Usage

Rip 2.8_20130801 - CLI RegRipper tool	
Rip [-r Reg hive file] [-f plugin file] [-p plugin module] [-l] [-h]
Parse Windows Registry files, using either a single module, or a plugins file.
  -r Reg hive file...Registry hive file to parse
  -g ................Guess the hive file (experimental)
  -f [profile].......use the plugin file (default: plugins\\plugins)
  -p plugin module...use only this module
  -l ................list all plugins
  -c ................Output list in CSV format (use with -l)
  -s system name.....Server name (TLN support)
  -u username........User name (TLN support)
  -h.................Help (print this information)
  
Ex: C:\\>rip -r c:\\case\\system -f system
    C:\\>rip -r c:\\case\\ntuser.dat -p userassist
    C:\\>rip -l -c
All output goes to STDOUT; use redirection (ie, > or >>) to output to a file\.
  
copyright 2013 Quantum Analytics Research, LLC

Examples

rip.pl -r SAM -f sam > /cases/sam.txt

rip.pl -r SYSTEM -f system > /cases/system.txt

Blog Posts

Registry Explorer

Description

A registry viewer powered by plugins.

Platform	Windows
Author	Eric Zimmerman
License	MIT License
URL	https://ericzimmerman.github.io/#!index.md

Usage

To load hives, drag and drop onto any of the three main panels. You can also use the File menu to load hives.

Once hives are loaded, Registry Explorer operates much like regedit.exe does, but with many more options.

Bookmarks

The Bookmarks menu will dynamically update to reflect which bookmarks are available in the currently selected hive.

Available Bookmarks

The available bookmarks tab displays all available bookmarks across all loaded hives.

Context menu

Right click on Nodes in the tree for various options such as exporting keys, full technical details, etc.

For full details, see the included manual.

Examples

Blog Posts

AppCompatCacheParser

Description

Parses appcompatchcache entries from the SYSTEM hive.

Platform	Windows
Author	Eric Zimmerman
License	MIT License
URL	AppCompatCacheParser

Usage

AppCompatCache Parser version 1.4.4.0

Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/AppCompatCacheParser

        c               The ControlSet to parse. Default is to extract all control sets.
        f               Full path to SYSTEM hive to process. If this option is not specified, the live Registry will be used
        t               Sorts last modified timestamps in descending order

        csv             Directory to save CSV formatted results to. Required
        csvf            File name to save CSV formatted results to. When present, overrides default name

        debug           Debug mode
        dt              The custom date/time format to use when displaying timestamps. See https://goo.gl/CNVq0k for options. Default is: yyyy-MM-dd HH:mm:ss
        nl              When true, ignore transaction log files for dirty hives. Default is FALSE

Examples: AppCompatCacheParser.exe --csv c:\temp -t -c 2
          AppCompatCacheParser.exe --csv c:\temp --csvf results.csv

          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

Examples

appcompatcacheparser -f SYSTEM.hve –csv C:\windows\temp

This command will search the SYSTEM hive for AppCompatCache results and save them to CSV formatted file in the Temp directory.

Blog Posts

PECmd

Description

A command line prefetch parser.

Platform	Windows
Author	Eric Zimmerman
License	MIT License
URL	https://github.com/EricZimmerman/PECmd

Usage

        d               Directory to recursively process. Either this or -f is required
        f               File to process. Either this or -d is required
        k               Comma separated list of keywords to highlight in output. By default, 'temp' and 'tmp' are highlighted. Any additional keywords will be added to these.
        o               When specified, save prefetch file bytes to the given path. Useful to look at decompressed Win10 files
        q               Do not dump full details about each file processed. Speeds up processing when using --json or --csv. Default is FALSE
 
        json            Directory to save json representation to.
        jsonf           File name to save JSON formatted results to. When present, overrides default name
        csv             Directory to save CSV results to. Be sure to include the full path in double quotes
        csvf            File name to save CSV formatted results to. When present, overrides default name
        html            Directory to save xhtml formatted results to. Be sure to include the full path in double quotes
        dt              The custom date/time format to use when displaying timestamps. See https://goo.gl/CNVq0k for options. Default is: yyyy-MM-dd HH:mm:ss
        mp              When true, display higher precision for timestamps. Default is FALSE
 
        vss             Process all Volume Shadow Copies that exist on drive specified by -f or -d . Default is FALSE
        dedupe          Deduplicate -f or -d & VSCs based on SHA-1. First file found wins. Default is TRUE
 
        debug           Show debug information during processing
        trace           Show trace information during processing
 
Examples: PECmd.exe -f "C:\Temp\CALC.EXE-3FBEF7FD.pf"
          PECmd.exe -f "C:\Temp\CALC.EXE-3FBEF7FD.pf" --json "D:\jsonOutput" --jsonpretty
          PECmd.exe -d "C:\Temp" -k "system32, fonts"
          PECmd.exe -d "C:\Temp" --csv "c:\temp" --csvf foo.csv --json c:\temp\json
          PECmd.exe -d "C:\Windows\Prefetch"
 
          Short options (single letter) are prefixed with a single dash. Long commands are prefixed with two dashes

Examples

Blog Posts

Tag: windows artifacts