# Windows Analysis

### amcache.py

Website: Original (<https://github.com/williballenthin/python-registry)\\>
Description: AmCache Registry Hive Parser\
Author: Willi Ballenthin and Corey Forman\
License: Apache License 2.0 (<https://github.com/williballenthin/python-registry/blob/master/LICENSE.TXT)\\>
Version: 2.0\
Notes: This version has been modified from the original, and is not stored online at this time

### Autorunner

Website: <https://github.com/woanware/autorunner\\>
Description: Checks for autorun applications on Windows\
Author: Mark Woan\
License: Public Domain\
Version: 0.0.16\
Notes:

### autotimeliner

Website: <https://github.com/andreafortuna/autotimeliner\\>
Description: Timeline generator using Sleuthkit and Volatility\
Author: Andrea Fortuna\
License: MIT License (<https://github.com/andreafortuna/autotimeliner/blob/master/LICENSE)\\>
Version: 1.1.0\
Notes:

### bitsparser

Website: <https://github.com/digitalsleuth/bitsparser\\>
Description: A python tool to parse Windows BITS database files\
Author: Corey Forman / FireEye\
License: Apache License v2.0 (<https://github.com/digitalsleuth/BitsParser/blob/master/LICENSE)\\>
Version: 1.0\
Notes:

### bmc-tools

Website: <https://github.com/ANSSI-FR/bmc-tools\\>
Description: Parse Bitmap Cache RDP files\
Author: ANSSI-FR\
License: CeCILL Free Software License Agreement v2.1 (<https://github.com/ANSSI-FR/bmc-tools/blob/master/LICENCE.txt)\\>
Version: 3.02\
Notes:

### Hibernation-Recon

Website: <https://arsenalrecon.com\\>
Description: Tool to parse a Windows hibernation file\
Author: Arsenal Recon\
License: EULA\
Version: 1.2.2.86\
Notes: Available, but not installed by default

### Hindsight

Website: <https://github.com/obsidianforensics/hindsight\\>
Description: Web-based Chromium Browser artifact parser (Chrome origins)\
Author: Obsidian Forensics\
License: Apache v2.0 (<https://github.com/obsidianforensics/hindsight/blob/master/LICENSE.md)\\>
Version: 2023.03\
Notes:

### Kansa

Website: <https://github.com/davehull/kansa\\>
Description: Powershell Incident Response Framework\
Author: Dave Hull\
License: Apache License v2.0 (<https://github.com/davehull/Kansa/blob/master/LICENSE)\\>
Version: 18NOV2022 (No defined version)\
Notes:

### kape

Website: <https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape\\>
Description: Incident Response Artifact Parser and Extractor\
Author: Eric Zimmerman / Kroll\
License: <https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape\\>
Version: 1.3.0.2\
Notes:

### Live Response Collection (Cedarpelta)

Website: <https://www.brimorlabs.com/tools/\\>
Description: Incident Response Artifact Parser and Extractor\
Author: Brian Moran\
License: GNU General Public License v3.0 (see COPYING in zip file)\
Version: Cedarpelta - 20190905\
Notes: Also does macOS and Linux collection

### LogFileParser

Website: <https://github.com/jschicht/LogFileParser\\>
Description: NTFS $LogFile Parser\
Author: Joakim Schicht\
License: MIT (<https://github.com/jschicht/LogFileParser/blob/master/LICENSE.md)\\>
Version: 2.0.0.50\
Notes:

### MFT Browser

Website: <https://github.com/kacos2000/MFT\\_Browser\\>
Description: Graphical MFT Browser utility\
Author: Costas K.\
License: MIT License (<https://github.com/kacos2000/MFT\\_Browser/blob/master/LICENSE)\\>
Version: 1.0.72.0\
Notes:

### Mimikatz

Website: <https://github.com/gentilkiwi/mimikatz\\>
Description: Windows-based hash extraction tool\
Author: Benjamin Delpy\
License: Creative Commons BY 4.0\
Version: 2.2.0-20220919\
Notes: Detects as a virus in Windows - Exclusion gets added during install

### MiTeC Tool Suite

Website: <https://mitec.cz\\>
Description: Suite of Windows-based analysis tools\
Author: Michal Mutl (mitec)\
License: Free to use for private, educational and non-commercial purposes\
Version: Various\
Notes:

### Nirsoft

Website: <https://nirsoft.net\\>
Description: Suite of various Windows Analysis Tools\
Author: Nir Sofer\
License:\
Version: 1.30.6\
Notes:

### NTFS Log Tracker

Website: <https://sites.google.com/site/forensicnote/ntfs-log-tracker\\>
Description: NTFS $LogFile, $UsnJrnl:$J parser\
Author: Junghoon Oh (blueangel)\
License:\
Version: 1.71\
Notes:

### OneDriveExplorer

Website: <https://github.com/Beercow/OneDriveExplorer\\>
Description: Command-line and GUI tool for viewing OneDrive folder structure\
Author: Brian Maloney\
License: MIT License (<https://github.com/Beercow/OneDriveExplorer/blob/master/LICENSE)\\>
Version: 2023.09.22\
Notes:

### Shadow Explorer

Website: <https://www.shadowexplorer.com\\>
Description: Windows Volume Shadow Copy viewer\
Author: ShadowExplorer\
License:\
Version: 0.9.462.0\
Notes:

### SilkETW

Website: <https://github.com/mandiant/SilkETW\\>
Description: Wrapper for ETW (Event Tracing for Windows)\
Author: Mandiant\
License: Apache License v2 (<https://github.com/mandiant/SilkETW/raw/master/LICENSE.txt>) 3rd-party license (<https://github.com/mandiant/SilkETW/blob/master/LICENSE-3RD-PARTY.txt)\\>
Version: 0.8\
Notes: Sample Usage - <https://www.mandiant.com/resources/blog/silketw-because-free-telemetry-is-free>

### srum-dump

Website: <https://github.com/MarkBaggett/srum-dump\\>
Description: Tool to analyze data in the Windows System Resource Usage Monitor database\
Author: Mark Baggett\
License: GNU General Public License v3 (<https://github.com/MarkBaggett/srum-dump/blob/master/LICENSE)\\>
Version: 2.5\
Notes:

### Sysinternals

Website: <https://sysinternals.com\\>
Description: Suite of Windows Analysis and Management Tools\
Author: Microsoft / Mark Russinovich\
License: <https://learn.microsoft.com/en-us/sysinternals/license-terms\\>
Version: 2023.11.13 (date of last update - no specific version number identified)\
Notes:

### The Sleuth Kit

Website: <https://github.com/sleuthkit/sleuthkit/\\>
Description: Library and collection of command line DFIR tools\
Author: Brian Carrier\
License: Multiple Licenses (<https://www.sleuthkit.org/sleuthkit/licenses.php)\\>
Version: 4.12.1\
Notes:

### ThumbCache Viewer

Website: <https://thumbcacheviewer.github.io/\\>
Description: Windows Thumbnail Cache parser\
Author: Eric Kutcher\
License: GNU General Public License v3.0 (identified within program)\
Version: 1.0.3.9\
Notes:

### USB Detective

Website: <https://usbdetective.com\\>
Description: Windows USB analysis tool\
Author: Jason Hale\
License: Software License Agreement (<https://usbdetective.com/docs/usbdla.pdf)\\>
Version: 1.6.3\
Notes: Available, but not installed by default

### usbdeviceforensics

Website: <https://github.com/digitalsleuth/usbdeviceforensics\\>
Description: Track a USB device throughout a Windows system\
Author: Corey Forman / Mark Woan\
License: Public Domain\
Version: 1.0.0\
Notes:

### USN Journal Parser

Website: <https://github.com/digitalsleuth/USN-Journal-Parser\\>
Description: Updated version of PoorBillionaire's USN-Journal-Parser\
Author: Corey Forman / Adam Witt\
License: MIT License (<https://github.com/digitalsleuth/USN-Journal-Parser/blob/main/LICENSE)\\>
Version: 5.0.0\
Notes: Commands: usn, usn.py

### Velociraptor

Website: <https://docs.velociraptor.app/\\>
Description: DFIR live acquisition tool\
Author: Mike Cohen (scudette)\
License: GNU Affero General Public License v3 (<https://github.com/Velocidex/velociraptor/blob/master/LICENSE)\\>
Version: 0.7.0-3\
Notes:

### Volatility

Website: <https://github.com/volatilityfoundation/volatility\\>
Description: Memory analysis toolset\
Author: <https://github.com/volatilityfoundation/volatility/blob/master/AUTHORS.txt\\>
License: GNU General Public License v2 (<https://github.com/volatilityfoundation/volatility/blob/master/LICENSE.txt)\\>
Version: 2\
Notes:

### Volatility3

Website: <https://github.com/volatilityfoundation/volatility3\\>
Description: Memory analysis toolset\
Author: Volatility Foundation\
License: Volatility Software License (<https://www.volatilityfoundation.org/license/vsl-v1.0)\\>
Version: 3\
Notes:

### Volatility Workbench

Website: <https://www.osforensics.com/tools/volatility-workbench.html\\>
Description: Windows-based GUI for the Volatility 3 Framework\
Author: OSForensics\
License: Volatility Software License (<https://www.volatilityfoundation.org/license/vsl-v1.0)\\>
Version: 3.0.1006\
Notes:

### vssmount

Website: <https://github.com/digitalsleuth/forensics\\_tools\\>
Description: Windows Batch script to work with and mount Volume Shadow Copies\
Author: Corey Forman (digitalsleuth)\
License: GNU General Public License v3 (<https://github.com/digitalsleuth/forensics\\_tools/blob/master/LICENSE)\\>
Version: 2.0\
Notes:

### Windows Timeline

Website: <https://github.com/kacos2000/WindowsTimeline\\>
Description: Windows Timeline / Activities Cache parser\
Author: Costas K.\
License: Mozilla Public License v2.0 (<https://github.com/kacos2000/WindowsTimeline/blob/master/LICENSE)\\>
Version: 2.0.82.0\
Notes:

### WLEAPP

Website: <https://github.com/abrignoni/wleapp\\>
Description: Windows Logs Events and Properties Parser\
Author: Alexis Brignoni\
License: MIT License (<https://github.com/abrignoni/WLEAPP/blob/main/LICENSE)\\>
Version: 0.1\
Notes:

### WMI Parser

Website: <https://github.com/woanware/wmi-parser\\>
Description: Parse the WMI object database for persistence\
Author: Mark Woan\
License: Unknown\
Version: 0.0.2\
Notes:

### Zimmerman Tools

Website: <https://ericzimmerman.github.io\\>
Description: Suite of Forensic Tools\
Author: Eric Zimmerman\
License: MIT License (<https://github.com/EricZimmerman/Issues/blob/master/LICENSE)\\>
Version: 2023-05-18\
Notes:


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://digitalsleuth.gitbook.io/win-for-documentation/the-tools/windows-analysis.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.