{"slug": "forensics", "title": "Forensics", "description": "Uncover the dirty little secrets of a recovered HDD, Image, malware, and more.", "sections": [{"title": "", "groups": [{"title": "Blockchain", "tools": [{"name": "Orbit", "url": "https://github.com/s0md3v/Orbit", "description": "Blockchain Transactions Investigation Tool.", "repo": "s0md3v/Orbit", "_anchor": "orbit", "_section": "", "_group": "Blockchain", "_tabs": ["blockchain"], "_tab_titles": ["Blockchain"], "_page": "/tools/orbit/"}]}, {"title": "Browser", "tools": [{"name": "Hindsight", "url": "https://github.com/obsidianforensics/hindsight", "description": "Web browser forensics for Google Chrome/Chromium.", "repo": "obsidianforensics/hindsight", "_anchor": "hindsight", "_section": "", "_group": "Browser", "_tabs": ["browser"], "_tab_titles": ["Browser"], "_page": "/tools/hindsight/"}]}, {"title": "Disk Images", "tools": [{"name": "AFFLIBv3", "url": "https://github.com/sshock/AFFLIBv3", "description": "AFF is an open and extensible file format to store disk images and associated metadata.", "repo": "sshock/AFFLIBv3", "_anchor": "afflibv3", "_section": "", "_group": "Disk Images", "_tabs": ["disk-images"], "_tab_titles": ["Disk Images"], "_page": "/tools/afflibv3/"}, {"name": "Autopsy", "url": "https://www.sleuthkit.org/autopsy/", "description": "A digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.", "_anchor": "autopsy", "_section": "", "_group": "Disk Images", "_tabs": ["disk-images"], "_tab_titles": ["Disk Images"], "_page": "/tools/autopsy/"}, {"name": "DMG2IMG", "url": "https://github.com/Lekensteyn/dmg2img", "description": "DMG2IMG is a tool which allows converting Apple compressed dmg archives to standard (hfsplus) image disk files.", "repo": "Lekensteyn/dmg2img", "_anchor": "dmg2img", "_section": "", "_group": "Disk Images", "_tabs": ["disk-images"], "_tab_titles": ["Disk Images"], "_page": "/tools/dmg2img/"}]}, {"title": "Images/Documents", "tools": [{"name": "Disk Drill", "url": "https://www.disk-drill.com", "description": "Recover deleted files for Mac and Windows.", "_anchor": "disk-drill", "_section": "", "_group": "Images/Documents", "_tabs": ["images-documents"], "_tab_titles": ["Images/Documents"], "_page": "/tools/disk-drill/"}, {"name": "Exfiltool", "url": "https://exiftool.org/", "description": "Tool for reading, writing and editing meta information.", "_anchor": "exfiltool", "_section": "", "_group": "Images/Documents", "_tabs": ["images-documents"], "_tab_titles": ["Images/Documents"], "_page": "/tools/exfiltool/"}, {"name": "FOCA", "url": "https://github.com/ElevenPaths/FOCA", "description": "Tool to find metadata and hidden information in the documents.", "repo": "ElevenPaths/FOCA", "_anchor": "foca", "_section": "", "_group": "Images/Documents", "_tabs": ["images-documents"], "_tab_titles": ["Images/Documents"], "_page": "/tools/foca/"}]}, {"title": "Mobile", "tools": [{"name": "Andriller", "url": "https://github.com/den4uk/andriller", "description": "Performs read-only, forensically sound, non-destructive acquisition from Android devices.", "repo": "den4uk/andriller", "_anchor": "andriller", "_section": "", "_group": "Mobile", "_tabs": ["mobile"], "_tab_titles": ["Mobile"], "_page": "/tools/andriller/"}]}, {"title": "Scripts", "tools": [{"name": "DissectingMalwa.re Lab", "url": "https://github.com/f0wl/MalwareLab_VM-Setup", "description": "Download/setup script for malware analysis/software reverse engineering.", "repo": "f0wl/MalwareLab_VM-Setup", "_anchor": "dissectingmalwa-re-lab", "_section": "", "_group": "Scripts", "_tabs": ["scripts"], "_tab_titles": ["Scripts"], "_page": "/tools/dissectingmalwa-re-lab/"}]}, {"title": "SQL", "tools": [{"name": "DFIR SQL Query", "url": "https://github.com/abrignoni/DFIR-SQL-Query-Repo", "description": "Download/setup script for malware analysis/software reverse engineering.   -.", "repo": "abrignoni/DFIR-SQL-Query-Repo", "_anchor": "dfir-sql-query", "_section": "", "_group": "SQL", "_tabs": ["sql"], "_tab_titles": ["SQL"], "_page": "/tools/dfir-sql-query/"}]}, {"title": "Tools", "tools": [{"name": "Beagle", "url": "https://github.com/yampelo/beagle", "description": "Digital forensics tool which transforms security logs and data into graphs.", "repo": "yampelo/beagle", "_anchor": "beagle", "_section": "", "_group": "Tools", "_tabs": ["tools"], "_tab_titles": ["Tools"], "_page": "/tools/beagle/"}]}, {"title": "Windows", "tools": [{"name": "AmcacheParser", "url": "https://github.com/EricZimmerman/AmcacheParser", "description": "Parses amcache.hve files, but with a twist. -.", "repo": "EricZimmerman/AmcacheParser", "_anchor": "amcacheparser", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/amcacheparser/"}, {"name": "AppCompatCacheParser", "url": "https://github.com/EricZimmerman/AppCompatCacheParser", "description": "AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10. -.", "repo": "EricZimmerman/AppCompatCacheParser", "_anchor": "appcompatcacheparser", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/appcompatcacheparser/"}, {"name": "Auditpol", "url": "https://docs.microsoft.com/en-gb/windows-server/administration/windows-commands/auditpol", "description": "Displays information about and performs functions to manipulate audit policies.", "_anchor": "auditpol", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/auditpol/"}, {"name": "EvtxECmd", "url": "https://github.com/EricZimmerman/evtx", "description": "C# based evtx parser with lots of extras. -.", "repo": "EricZimmerman/evtx", "_anchor": "evtxecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/evtxecmd/"}, {"name": "ExtensionBlocks", "url": "https://github.com/EricZimmerman/ExtensionBlocks", "description": "Extension blocks as found in ShellBags and other places in the Registry. -.", "repo": "EricZimmerman/ExtensionBlocks", "_anchor": "extensionblocks", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/extensionblocks/"}, {"name": "iisGeolocate", "url": "https://github.com/EricZimmerman/iisGeolocate", "description": "geolocate ip addresses in IIS logs. -.", "repo": "EricZimmerman/iisGeolocate", "_anchor": "iisgeolocate", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/iisgeolocate/"}, {"name": "JLECmd", "url": "https://github.com/EricZimmerman/JLECmd", "description": "Automatic and Custom Destinations jump list parser with Windows 10 support. -.", "repo": "EricZimmerman/JLECmd", "_anchor": "jlecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/jlecmd/"}, {"name": "KAPE Files", "url": "https://github.com/EricZimmerman/KapeFiles", "description": "This repository serves as a place for community created Targets and Modules for use with KAPE. -.", "repo": "EricZimmerman/KapeFiles", "_anchor": "kape-files", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/kape-files/"}, {"name": "LECmd", "url": "https://github.com/EricZimmerman/LECmd", "description": "Lnk Explorer Command line edition!.", "repo": "EricZimmerman/LECmd", "_anchor": "lecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/lecmd/"}, {"name": "Lnk", "url": "https://github.com/EricZimmerman/Lnk", "description": "Lnk file parser.", "repo": "EricZimmerman/Lnk", "_anchor": "lnk", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/lnk/"}, {"name": "MFT", "url": "https://github.com/EricZimmerman/MFT", "description": "MFT parser.", "repo": "EricZimmerman/MFT", "_anchor": "mft", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/mft/"}, {"name": "MFTECmd", "url": "https://github.com/EricZimmerman/MFTECmd", "description": "Parses $MFT from NTFS file systems.", "repo": "EricZimmerman/MFTECmd", "_anchor": "mftecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/mftecmd/"}, {"name": "OleCF", "url": "https://github.com/EricZimmerman/OleCf", "description": "Library to process OLE compound file format.", "repo": "EricZimmerman/OleCf", "_anchor": "olecf", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/olecf/"}, {"name": "PECmd", "url": "https://github.com/EricZimmerman/PECmd", "description": "Prefetch Explorer Command Line.", "repo": "EricZimmerman/PECmd", "_anchor": "pecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/pecmd/"}, {"name": "Prefetch", "url": "https://github.com/EricZimmerman/Prefetch", "description": "Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10. -   -.", "repo": "EricZimmerman/Prefetch", "_anchor": "prefetch", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/prefetch/"}, {"name": "RBCmd", "url": "https://github.com/EricZimmerman/RBCmd", "description": "Recycle bin artifact parser.", "repo": "EricZimmerman/RBCmd", "_anchor": "rbcmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/rbcmd/"}, {"name": "Registry", "url": "https://github.com/EricZimmerman/Registry", "description": "Full featured, offline Registry parser in C#.", "repo": "EricZimmerman/Registry", "_anchor": "registry", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/registry/"}, {"name": "Registry Explorer Bookmarks", "url": "https://github.com/EricZimmerman/RegistryExplorerBookmarks", "description": "Registry Explorer bookmark definitions. -.", "repo": "EricZimmerman/RegistryExplorerBookmarks", "_anchor": "registry-explorer-bookmarks", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/registry-explorer-bookmarks/"}, {"name": "SDB", "url": "https://github.com/EricZimmerman/SDB", "description": "Parse Microsoft shim databases.", "repo": "EricZimmerman/SDB", "_anchor": "sdb", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/sdb/"}, {"name": "SQLECmd", "url": "https://github.com/EricZimmerman/SQLECmd", "description": "This repo that contains all the Maps used by Eric Zimmerman's SQLECmd. -.", "repo": "EricZimmerman/SQLECmd", "_anchor": "sqlecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/sqlecmd/"}, {"name": "SrumECmd", "url": "https://github.com/EricZimmerman/Srum", "description": "SRUM parser.", "repo": "EricZimmerman/Srum", "_anchor": "srumecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/srumecmd/"}, {"name": "SumECmd", "url": "https://github.com/EricZimmerman/Sum", "description": "Process Microsoft User Access Log.", "repo": "EricZimmerman/Sum", "_anchor": "sumecmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/sumecmd/"}, {"name": "TLEFilePlugins", "url": "https://github.com/EricZimmerman/TLEFilePlugins", "description": "Plugins for parsing CSV files in Timeline Explorer. -.", "repo": "EricZimmerman/TLEFilePlugins", "_anchor": "tlefileplugins", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/tlefileplugins/"}, {"name": "USBDevices", "url": "https://github.com/EricZimmerman/USBDevices", "description": "Get USB Devices from Registry hives.", "repo": "EricZimmerman/USBDevices", "_anchor": "usbdevices", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/usbdevices/"}, {"name": "VSCMount", "url": "https://github.com/EricZimmerman/VSCMount", "description": "Mount VSCs with ease!.", "repo": "EricZimmerman/VSCMount", "_anchor": "vscmount", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/vscmount/"}, {"name": "WinSearchDBAnalyzer", "url": "https://github.com/EricZimmerman/WinSearchDBAnalyzer", "description": "Parse normal records and recover deleted records in Windows.edb.", "repo": "EricZimmerman/WinSearchDBAnalyzer", "_anchor": "winsearchdbanalyzer", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/winsearchdbanalyzer/"}, {"name": "WtTCmd", "url": "https://github.com/EricZimmerman/WxTCmd", "description": "Parser for the Windows 10 Timeline feature database.", "repo": "EricZimmerman/WxTCmd", "_anchor": "wttcmd", "_section": "", "_group": "Windows", "_tabs": ["windows"], "_tab_titles": ["Windows"], "_page": "/tools/wttcmd/"}]}]}], "tools": [{"name": "AFFLIBv3", "url": "https://github.com/sshock/AFFLIBv3", "description": "AFF is an open and extensible file format to store disk images and associated metadata.", "category": "forensics", "section": "", "group": "Disk Images", "repo": "sshock/AFFLIBv3", "links": [], "tags": [], "path": "/tools/afflibv3/", "listing": "/forensics/#afflibv3"}, {"name": "AmcacheParser", "url": "https://github.com/EricZimmerman/AmcacheParser", "description": "Parses amcache.hve files, but with a twist. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/AmcacheParser", "links": [], "tags": [], "path": "/tools/amcacheparser/", "listing": "/forensics/#amcacheparser"}, {"name": "Andriller", "url": "https://github.com/den4uk/andriller", "description": "Performs read-only, forensically sound, non-destructive acquisition from Android devices.", "category": "forensics", "section": "", "group": "Mobile", "repo": "den4uk/andriller", "links": [], "tags": [], "path": "/tools/andriller/", "listing": "/forensics/#andriller"}, {"name": "AppCompatCacheParser", "url": "https://github.com/EricZimmerman/AppCompatCacheParser", "description": "AppCompatCache (shimcache) parser. Supports Windows 7 (x86 and x64), Windows 8.x, and Windows 10. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/AppCompatCacheParser", "links": [], "tags": [], "path": "/tools/appcompatcacheparser/", "listing": "/forensics/#appcompatcacheparser"}, {"name": "Auditpol", "url": "https://docs.microsoft.com/en-gb/windows-server/administration/windows-commands/auditpol", "description": "Displays information about and performs functions to manipulate audit policies.", "category": "forensics", "section": "", "group": "Windows", "repo": null, "links": [], "tags": [], "path": "/tools/auditpol/", "listing": "/forensics/#auditpol"}, {"name": "Autopsy", "url": "https://www.sleuthkit.org/autopsy/", "description": "A digital forensics platform and graphical interface to The Sleuth Kit® and other digital forensics tools.", "category": "forensics", "section": "", "group": "Disk Images", "repo": null, "links": [], "tags": [], "path": "/tools/autopsy/", "listing": "/forensics/#autopsy"}, {"name": "Beagle", "url": "https://github.com/yampelo/beagle", "description": "Digital forensics tool which transforms security logs and data into graphs.", "category": "forensics", "section": "", "group": "Tools", "repo": "yampelo/beagle", "links": [], "tags": [], "path": "/tools/beagle/", "listing": "/forensics/#beagle"}, {"name": "DFIR SQL Query", "url": "https://github.com/abrignoni/DFIR-SQL-Query-Repo", "description": "Download/setup script for malware analysis/software reverse engineering.   -.", "category": "forensics", "section": "", "group": "SQL", "repo": "abrignoni/DFIR-SQL-Query-Repo", "links": [], "tags": [], "path": "/tools/dfir-sql-query/", "listing": "/forensics/#dfir-sql-query"}, {"name": "Disk Drill", "url": "https://www.disk-drill.com", "description": "Recover deleted files for Mac and Windows.", "category": "forensics", "section": "", "group": "Images/Documents", "repo": null, "links": [], "tags": [], "path": "/tools/disk-drill/", "listing": "/forensics/#disk-drill"}, {"name": "DissectingMalwa.re Lab", "url": "https://github.com/f0wl/MalwareLab_VM-Setup", "description": "Download/setup script for malware analysis/software reverse engineering.", "category": "forensics", "section": "", "group": "Scripts", "repo": "f0wl/MalwareLab_VM-Setup", "links": [], "tags": [], "path": "/tools/dissectingmalwa-re-lab/", "listing": "/forensics/#dissectingmalwa-re-lab"}, {"name": "DMG2IMG", "url": "https://github.com/Lekensteyn/dmg2img", "description": "DMG2IMG is a tool which allows converting Apple compressed dmg archives to standard (hfsplus) image disk files.", "category": "forensics", "section": "", "group": "Disk Images", "repo": "Lekensteyn/dmg2img", "links": [], "tags": [], "path": "/tools/dmg2img/", "listing": "/forensics/#dmg2img"}, {"name": "EvtxECmd", "url": "https://github.com/EricZimmerman/evtx", "description": "C# based evtx parser with lots of extras. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/evtx", "links": [], "tags": [], "path": "/tools/evtxecmd/", "listing": "/forensics/#evtxecmd"}, {"name": "Exfiltool", "url": "https://exiftool.org/", "description": "Tool for reading, writing and editing meta information.", "category": "forensics", "section": "", "group": "Images/Documents", "repo": null, "links": [], "tags": [], "path": "/tools/exfiltool/", "listing": "/forensics/#exfiltool"}, {"name": "ExtensionBlocks", "url": "https://github.com/EricZimmerman/ExtensionBlocks", "description": "Extension blocks as found in ShellBags and other places in the Registry. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/ExtensionBlocks", "links": [], "tags": [], "path": "/tools/extensionblocks/", "listing": "/forensics/#extensionblocks"}, {"name": "FOCA", "url": "https://github.com/ElevenPaths/FOCA", "description": "Tool to find metadata and hidden information in the documents.", "category": "forensics", "section": "", "group": "Images/Documents", "repo": "ElevenPaths/FOCA", "links": [], "tags": [], "path": "/tools/foca/", "listing": "/forensics/#foca"}, {"name": "Hindsight", "url": "https://github.com/obsidianforensics/hindsight", "description": "Web browser forensics for Google Chrome/Chromium.", "category": "forensics", "section": "", "group": "Browser", "repo": "obsidianforensics/hindsight", "links": [], "tags": [], "path": "/tools/hindsight/", "listing": "/forensics/#hindsight"}, {"name": "iisGeolocate", "url": "https://github.com/EricZimmerman/iisGeolocate", "description": "geolocate ip addresses in IIS logs. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/iisGeolocate", "links": [], "tags": [], "path": "/tools/iisgeolocate/", "listing": "/forensics/#iisgeolocate"}, {"name": "JLECmd", "url": "https://github.com/EricZimmerman/JLECmd", "description": "Automatic and Custom Destinations jump list parser with Windows 10 support. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/JLECmd", "links": [], "tags": [], "path": "/tools/jlecmd/", "listing": "/forensics/#jlecmd"}, {"name": "KAPE Files", "url": "https://github.com/EricZimmerman/KapeFiles", "description": "This repository serves as a place for community created Targets and Modules for use with KAPE. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/KapeFiles", "links": [], "tags": [], "path": "/tools/kape-files/", "listing": "/forensics/#kape-files"}, {"name": "LECmd", "url": "https://github.com/EricZimmerman/LECmd", "description": "Lnk Explorer Command line edition!.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/LECmd", "links": [], "tags": [], "path": "/tools/lecmd/", "listing": "/forensics/#lecmd"}, {"name": "Lnk", "url": "https://github.com/EricZimmerman/Lnk", "description": "Lnk file parser.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/Lnk", "links": [], "tags": [], "path": "/tools/lnk/", "listing": "/forensics/#lnk"}, {"name": "MFT", "url": "https://github.com/EricZimmerman/MFT", "description": "MFT parser.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/MFT", "links": [], "tags": [], "path": "/tools/mft/", "listing": "/forensics/#mft"}, {"name": "MFTECmd", "url": "https://github.com/EricZimmerman/MFTECmd", "description": "Parses $MFT from NTFS file systems.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/MFTECmd", "links": [], "tags": [], "path": "/tools/mftecmd/", "listing": "/forensics/#mftecmd"}, {"name": "OleCF", "url": "https://github.com/EricZimmerman/OleCf", "description": "Library to process OLE compound file format.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/OleCf", "links": [], "tags": [], "path": "/tools/olecf/", "listing": "/forensics/#olecf"}, {"name": "Orbit", "url": "https://github.com/s0md3v/Orbit", "description": "Blockchain Transactions Investigation Tool.", "category": "forensics", "section": "", "group": "Blockchain", "repo": "s0md3v/Orbit", "links": [], "tags": [], "path": "/tools/orbit/", "listing": "/forensics/#orbit"}, {"name": "PECmd", "url": "https://github.com/EricZimmerman/PECmd", "description": "Prefetch Explorer Command Line.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/PECmd", "links": [], "tags": [], "path": "/tools/pecmd/", "listing": "/forensics/#pecmd"}, {"name": "Prefetch", "url": "https://github.com/EricZimmerman/Prefetch", "description": "Windows Prefetch parser. Supports all known versions from Windows XP to Windows 10. -   -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/Prefetch", "links": [], "tags": [], "path": "/tools/prefetch/", "listing": "/forensics/#prefetch"}, {"name": "RBCmd", "url": "https://github.com/EricZimmerman/RBCmd", "description": "Recycle bin artifact parser.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/RBCmd", "links": [], "tags": [], "path": "/tools/rbcmd/", "listing": "/forensics/#rbcmd"}, {"name": "Registry", "url": "https://github.com/EricZimmerman/Registry", "description": "Full featured, offline Registry parser in C#.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/Registry", "links": [], "tags": [], "path": "/tools/registry/", "listing": "/forensics/#registry"}, {"name": "Registry Explorer Bookmarks", "url": "https://github.com/EricZimmerman/RegistryExplorerBookmarks", "description": "Registry Explorer bookmark definitions. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/RegistryExplorerBookmarks", "links": [], "tags": [], "path": "/tools/registry-explorer-bookmarks/", "listing": "/forensics/#registry-explorer-bookmarks"}, {"name": "SDB", "url": "https://github.com/EricZimmerman/SDB", "description": "Parse Microsoft shim databases.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/SDB", "links": [], "tags": [], "path": "/tools/sdb/", "listing": "/forensics/#sdb"}, {"name": "SQLECmd", "url": "https://github.com/EricZimmerman/SQLECmd", "description": "This repo that contains all the Maps used by Eric Zimmerman's SQLECmd. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/SQLECmd", "links": [], "tags": [], "path": "/tools/sqlecmd/", "listing": "/forensics/#sqlecmd"}, {"name": "SrumECmd", "url": "https://github.com/EricZimmerman/Srum", "description": "SRUM parser.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/Srum", "links": [], "tags": [], "path": "/tools/srumecmd/", "listing": "/forensics/#srumecmd"}, {"name": "SumECmd", "url": "https://github.com/EricZimmerman/Sum", "description": "Process Microsoft User Access Log.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/Sum", "links": [], "tags": [], "path": "/tools/sumecmd/", "listing": "/forensics/#sumecmd"}, {"name": "TLEFilePlugins", "url": "https://github.com/EricZimmerman/TLEFilePlugins", "description": "Plugins for parsing CSV files in Timeline Explorer. -.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/TLEFilePlugins", "links": [], "tags": [], "path": "/tools/tlefileplugins/", "listing": "/forensics/#tlefileplugins"}, {"name": "USBDevices", "url": "https://github.com/EricZimmerman/USBDevices", "description": "Get USB Devices from Registry hives.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/USBDevices", "links": [], "tags": [], "path": "/tools/usbdevices/", "listing": "/forensics/#usbdevices"}, {"name": "VSCMount", "url": "https://github.com/EricZimmerman/VSCMount", "description": "Mount VSCs with ease!.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/VSCMount", "links": [], "tags": [], "path": "/tools/vscmount/", "listing": "/forensics/#vscmount"}, {"name": "WinSearchDBAnalyzer", "url": "https://github.com/EricZimmerman/WinSearchDBAnalyzer", "description": "Parse normal records and recover deleted records in Windows.edb.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/WinSearchDBAnalyzer", "links": [], "tags": [], "path": "/tools/winsearchdbanalyzer/", "listing": "/forensics/#winsearchdbanalyzer"}, {"name": "WtTCmd", "url": "https://github.com/EricZimmerman/WxTCmd", "description": "Parser for the Windows 10 Timeline feature database.", "category": "forensics", "section": "", "group": "Windows", "repo": "EricZimmerman/WxTCmd", "links": [], "tags": [], "path": "/tools/wttcmd/", "listing": "/forensics/#wttcmd"}]}