Windows Analysis

Tools to conduct forensic analysis on various Windows artifacts

Website: Original ( Description: AmCache Registry Hive Parser Author: Willi Ballenthin and Corey Forman License: Apache License 2.0 ( Version: 2.0 Notes: This version has been modified from the original, and is not stored online at this time


Website: Description: Checks for autorun applications on Windows Author: Mark Woan License: Public Domain Version: 0.0.16 Notes:


Website: Description: Timeline generator using Sleuthkit and Volatility Author: Andrea Fortuna License: MIT License ( Version: 1.1.0 Notes:


Website: Description: A python tool to parse Windows BITS database files Author: Corey Forman / FireEye License: Apache License v2.0 ( Version: 1.0 Notes:


Website: Description: Parse Bitmap Cache RDP files Author: ANSSI-FR License: CeCILL Free Software License Agreement v2.1 ( Version: 3.00 Notes:

Event Log Explorer

Website: Description: Windows Event Log Parser Author: FSPro License: Multiple ( Version: 5.3 Notes: 30 Day Trial


Website: Description: Web-based Chromium Browser artifact parser (Chrome origins) Author: Obsidian Forensics License: Apache v2.0 ( Version: 2021.12 Notes:


Website: Description: Powershell Incident Response Framework Author: Dave Hull License: Apache License v2.0 ( Version: 18NOV2022 (No defined version) Notes:


Website: Description: Incident Response Artifact Parser and Extractor Author: Eric Zimmerman / Kroll License: Version: Notes:


Website: Description: NTFS $LogFile Parser Author: Joakim Schicht License: MIT ( Version: Notes:

MagnetRamCapture (MRC)

Website: Description: Windows memory capture utility Author: Magnet Forensics License: EULA Version: 1.2.0 Notes:

MFT Browser

Website: Description: Graphical MFT Browser utility Author: Costas K. License: MIT License ( Version: Notes:

MiTeC Tool Suite

Website: Description: Suite of Windows-based analysis tools Author: Michal Mutl (mitec) License: Free to use for private, educational and non-commercial purposes Version: Various Notes:


Website: Description: Suite of various Windows Analysis Tools Author: Nir Sofer License: Version: 1.23.65 Notes:

NTFS Log Tracker

Website: Description: NTFS $LogFile, $UsnJrnl:$J parser Author: Junghoon Oh (blueangel) License: Version: 1.71 Notes:


Website: Description: Rapid triage tool using Windows in-built binaries Author: Corey Forman (digitalsleuth) License: GNU General Public License v3 ( Version: 2.4 Notes:

Shadow Explorer

Website: Description: Windows Volume Shadow Copy viewer Author: ShadowExplorer License: Version: 0.9.462.0 Notes:


Website: Description: Wrapper for ETW (Event Tracing for Windows) Author: Mandiant License: Apache License v2 ( 3rd-party license ( Version: 0.8 Notes: Sample Usage -


Website: Description: Tool to analyze data in the Windows System Resource Usage Monitor database Author: Mark Baggett License: GNU General Public License v3 ( Version: 2.4 Notes:


Website: Description: Suite of Windows Analysis and Management Tools Author: Microsoft / Mark Russinovich License: Version: 2023.01.25 (date of last update - no specific version number identified) Notes:

The Sleuth Kit

Website: Description: Library and collection of command line DFIR tools Author: Brian Carrier License: Multiple Licenses ( Version: 4.12.0 Notes:

ThumbCache Viewer

Website: Description: Windows Thumbnail Cache parser Author: Eric Kutcher License: GNU General Public License v3.0 (identified within program) Version: Notes:


Website: Description: Track a USB device throughout a Windows system Author: Corey Forman / Mark Woan License: Public Domain Version: 1.0.0 Notes:


Website: Description: DFIR live acquisition tool Author: Mike Cohen (scudette) License: GNU Affero General Public License v3 ( Version: 0.6.7-5 Notes:


Website: Description: Memory analysis toolset Author: License: GNU General Public License v2 ( Version: 2 Notes:


Website: Description: Memory analysis toolset Author: Volatility Foundation License: Volatility Software License ( Version: 3 Notes:


Website: Description: Windows Batch script to work with and mount Volume Shadow Copies Author: Corey Forman (digitalsleuth) License: GNU General Public License v3 ( Version: 2.0 Notes:

Windows Timeline

Website: Description: Windows Timeline / Activities Cache parser Author: Costas K. License: Mozilla Public License v2.0 ( Version: Notes:


Website: Description: Memory Acquisition Tool Author: Mike Cohen (scudette) License: Apache License v2 ( Version: 4.0.rc2 Notes:


Website: Description: Windows Logs Events and Properties Parser Author: Alexis Brignoni License: MIT License ( Version: 0.1 Notes:

WMI Parser

Website: Description: Parse the WMI object database for persistence Author: Mark Woan License: Unknown Version: 0.0.2 Notes:

Zimmerman Tools

Website: Description: Suite of Forensic Tools Author: Eric Zimmerman License: MIT License ( Version: 2021-01-22 Notes: