Command-Line Utilities

• NirCmd
  NirCmd is a small command-line utility that allows you to do some useful tasks without displaying any user interface. By running NirCmd with simple command-line option, you can write and delete values and keys in the Registry, write values into INI file, dial to your internet account or connect to a VPN network, restart windows or shut down the computer, create shortcut to a file, change the created/modified date of a file, change your display settings, and more...

• GetNir
  GetNir is a command-line tool for Windows that receives tab-delimited or comma-delimited data from other NirSoft tools through Standard input (stdin) , finds and extracts the desired values according to the specified filter expression and column names, and then sends these values to the Standard output (stdout).

• WirelessNetConsole
  WirelessNetConsole is a small console application that dumps all current detected wireless networks information into the standard output. For each wireless network, the following information is displayed: SSID, Signal Quality in %, PHY types, RSSI, MAC Address, Channel Frequency, and more.

• BluetoothCL
  BluetoothCL is a small console application that dumps all current detected bluetooth devices into the standard output. For each Bluetooth device, the following information is displayed: MAC Address, Name, Major Device Type, Minor Device Type, and optionally the company name of the device (if external file of MAC addresses - oui.txt is provided)

• RegFileExport
  RegFileExport is a small console application that allows you to easily extract data from offline Registry file located on another disk drive. RegFileExport read the Registry file, ananlyze it, and then export the Registry data into a standard .reg file of Windows. You can export the entire Registry file, or only a specific Registry key. RegFileExport may also be able to export some of the Registry data even when the Registry file is corrupted and cannot be loaded by Windows.

• RunFromProcess
  RunFromProcess is a command-line utility that allows you to run a program from another process that you choose. The program that you run will be executed as a child of the specified process and it'll run with the same user and security context of the specified parent process.

• AtNow
  AtNow is a command-line utility that schedules programs and commands to run in the near future.

• WhosIP
  WhosIP is a simple command-line utility that allows you to easily find all available information about an IP address: The owner of the IP address, the country/state name, IP addresses range, contact information (address, phone, fax, and email), and more.

• WhoisCL
  WhoisCL is a simple command-line utility that allows you to easily get information about a registered domain. It automatically connect to the right WHOIS server, according to the top-level domain name, and retrieve the WHOIS record of the domain. It supports both generic domains and country code domains.

• SNRemove
  This utility removes the reference to strong name signature from .NET exe and dll files. After removing the strong name reference, you can make any change you want in dll/exe file, without getting any exception or error message.

• DumpEDID
  DumpEDID is a small console application that extract the EDID ("Extended display identification data") records from your computer, analyze it, and dump it into the console window. EDID record provide essential information about your monitor: manufacture week/year, monitor manufacturer, monitor model, supported display modes, and so on... You can also get the EDID records of a remote computer, if you login to this computer with administrator rights. (DumpEDID is the console version of MonitorInfoView utility)

Desktop Utilities

• GUIPropView
  GUIPropView displays extensive information about all windows currently opened on your system. The upper pane of GUIPropView displays all top level windows, and when you select a window in the upper pane, the lower pane displays the list of all child windows of the selected top level window. You can also select one or more windows and then do some actions on them like close, hide, show, minimize, maximize, disable, enable, and so on...

• FileTypesMan
  FileTypesMan is an alternative to the 'File Types' tab in the 'Folder Options' of Windows. It displays the list of all file extensions and types registered on your computer. For each file type, the following information is displayed: Type Name, Description, MIME Type, Perceived Type, Flags, Browser Flags, and more. FileTypesMan also allows you to easily edit the properties and flags of each file type, as well as it allows you to add, edit, and remove actions in a file type.

• ShortcutsMan
  ShortcutsMan displays the details about all shortcuts that you have on your desktop and under your start menu. Broken shortcuts (shortcuts that point to file that doesn't exist) are automatically painted with pink color. You select one or more shortcuts, and then delete them, resolve them or save the shortcut's details to HTML/Text/XML file.

• OpenWithView
  OpenWithView is a small utility that displays the list of all available applications in the 'Open With' dialog-box of Windows, and allows you to easily disable/enable the applications in the list. When application is disabled, it won't be displayed in the 'Other Programs' section of the 'Open With' dialog-box. This utility can be useful if your 'Open With' window displays too much applications, and you want to remove the applications that you don't use frequently.

• SpecialFoldersView
  Windows operating system have dozens of special folders that are used for storing application settings and files, storing Internet files, saving temporary files, storing shortcuts to other files, and so on. This utility displays the list of all special folders in your system, and allows you to easily jump to the right folder simply by double-clicking the folder item. You can also save the list of all folder paths into text/html/xml file.

• WinLister
  This utility displays the list of opened windows on your system. For each window, some useful information is displayed: the title, the handle of window, location, size, class name, process number, the name of the program that created the window, and more... In addition, you can easily hide, show or close the selected windows, or save the windows list to text or HTML file.

• InsideClipboard
  Each time that you copy something into the clipboard for pasting it into another application, the copied data is saved into multiple formats. The main clipboard application of Windows only display the basic clipboard formats, like text and bitmaps, but doesn't display the list of all formats that are stored in the clipboard. InsideClipboard is a small utility that displays the binary content of all formats that are currently stored in the clipboard, and allow you to save the content of specific format into a binary file.

• Clipboardic
  Clipboardic is a small utility that listen to the clipboard activity, and each time that you copy something into the clipboard, it automatically save the copied data into Windows clipboard file (.clp). Later, when you need the copied data again, you can simply select the right clipboard file, and Clipboardic will automatically insert it into the clipboard. Clipboardic also allows you to easily share the clipboard data between multiple computers on your local network.

• CustomExplorerToolbar
  CustomExplorerToolbar is small utility for Windows 7 only, which allows you to easily customize the toolbar of Windows Explorer, and add buttons that were existed in previous versions of Windows, like Copy, Cut, Paste, Select All, and more. This utility also allows you to remove the toolbar buttons that you previously added.

• NirExt
  NirExt utility adds 3 useful context menu extensions to your Windows Explorer environment: Folder Properties: This option is available in the context menu when you right-click on a folder in your file system. It allows you change the icon of any folder you want, and change the text that appears when the mouse cursor moves over the folder. Advanced Run: This option is available in the context menu when you right-click on an executable file (*.EXE). It allows you to instantly run an application with command-line and some other options. Create Shortcut+: This option is available in the context menu when you right-click on any file in your system. It allows you to instantly create a shortcut and drop it into one of the following folders: Desktop, Start Menu, Programs folder under Start Menu, Common Desktop (for all users), Common Start Menu (for all users), and Common Programs folder (for all users) under Start Menu.

Outlook/Office Utilities

• NK2Edit
  Every time that you type an email address or name in the message window of MS-Outlook, it automatically offer you a list of users and email address that you can choose. This feature is known as 'AutoComplete' and Outlook automatically build this emails list according to user activity and save it into a file with .NK2 extension. In some circumstances, you may need to fix or modify the values appeared in the AutoComplete list, or you may want to remove unwanted email addresses and/or to add new email addresses. MS-Outlook doesn't provide any ability to edit this AutoComplete list, so this is where NK2Edit software can help you. NK2Edit is a real NK2 editor that allows you to modify all fields in NK2 file, delete unwanted records, add new records, repair corrupted nk2 files, merge 2 or more NK2 files into a single NK2 file, and more...

• OutlookAttachView
  OutlookAttachView scans all messages stored in your Outlook, and displays the list of all attached files that it finds. You can easily select one or more attachments and save all of them into the desired folder, as well as you can delete unwanted large attachments that take too much disk space in your mailbox. You can also save the list of attachments into xml/html/text/csv file.

• OutlookStatView
  OutlookStatView scans your Outlook mailbox, and display a general statistics about the users that you communicate via emails. For each user/email, the following information is displayed: The number of outgoing messages that you sent to the user (separated by to/cc/bcc), the number of incoming message that the user sent to you, the total size of messages sent by the user, the email client software used by this user, and the time range that you send/received emails with the specified user.

• OutlookAddressBookView
  OutlookAddressBookView is a simple utility that displays the details of all recipients stored in the address books of Microsoft Outlook. For every recipient entry, the following information is displayed: Email Address, Display Name, Address Type (MS-Exchange or SMTP), Street Address, Phone Number, Created Time, Modified Time (Works only with address books of Exchange server), and more... You can easily select one or more recipients from the list and export them into tab-delimited/comma-delimited/xml/html file, or copy them to the clipboard and then paste the list into Excel.

• OfficeIns - Microsoft Office Add-Ins Manager
  OfficeIns is a small utility that displays the details of all installed Microsoft Office add-ins on your computer, and allows you to disable/enable them.

Programmer Tools

• DLL Export Viewer
  This utility displays the list of all exported functions and their virtual memory addresses for the specified DLL files. You can easily copy the memory address of the desired function, paste it into your debugger, and set a breakpoint for this memory address. When this function is called, the debugger will stop in the beginning of this function.

• GDIView
  GDIView is a unique tool that displays the list of GDI handles (brushes, pens, fonts, bitmaps, and others) allocated by every process. It displays the total count for each type of GDI handle, as well as detailed information about each handle. This tool can be useful for developers that need to trace GDI resources leak in their software.

• HeapMemView
  HeapMemView is a small utility that allows you to view the content of all memory blocks allocated in the heap of the process that you select. This tool can be useful for developers that need to trace memory leaks in their software.

• DeviceIOView
  DeviceIOView allows you to watch the data transfer between a software or service and a device driver (DeviceIoControl calls). For each call to a device driver, the following information is displayed: Handle, Control Code, number of input bytes, number of output bytes, the name of the device handle, and all the input/output bytes, displayed as Hex dump.

• SimpleProgramDebugger
  SimpleProgramDebugger is a simple debugging tool that attaches to existing running program or starts a new program in debugging mode, and then displays all major debugging events occurs while the program is running, including Exception, Create Thread, Create Process, Exit Thread, Exit Process, Load DLL, Unload Dll, and Debug String. After the debugging events are accumulated, you can easily export them into comma-delimited/tab-delimited/xml/html file or copy them to the clipboard and then paste them into Excel or any other spreadsheet application.

Disk Utilities

SearchMyFiles v3.10 SearchMyFiles is an alternative to the standard "Search For Files And Folders" module of Windows. It allows you to easily search files in your system by wildcard, by last modified/created/last accessed time, by file attributes, by file content (text or binary search), and by the file size. SearchMyFiles allows you to make a very accurate search that cannot be done with Windows search. For Example: You can search all files created in the last 10 minutes with size between 500 and 700 bytes. After you made a search, you can select one or more files, and save the list into text/html/csv/xml file, or copy the list to the clipboard. DriveLetterView v1.50 DriveLetterView is a simple utility that allows you to view the list of all drive letter assignments in your system, including local drives, remote network drives, CD/DVD drives, and USB drives - even if they are not currently plugged. It also allows you to easily change a drive letter of USB devices and remote network shares, as well as to delete a drive letter of USB device that is not plugged. You can also use DriveLetterView to export the list of all drives into text/csv/html/xml file. DiskCountersView v1.27 DiskCountersView displays the system counters of each disk drive in your system, including the total number of read/write operations and the total number of read/write bytes. It also displays general drive information, like disk name, partition number, partition location, and so on. AppReadWriteCounter v1.26 AppReadWriteCounter is a tool for Windows that counts and displays the current file read/write operations of every application running on your system. It displays the number of read/write bytes, the number of read/write operations, current calculated read/write speed, and the details about the application (product name, product version, and so on) that makes the file read/write operations. FileActivityWatch v1.55 FileActivityWatch is a tool for Windows that displays information about every read/write/delete operation of files occurs on your system. For every file, FileActivityWatch displays the number of read/write bytes, number of read/write/delete operations, first and last read/write timestamp, and the name/ID of the process responsible for the file operation. FileAccessErrorView v1.22 FileAccessErrorView is a diagnostic tool for Windows that displays information about errors occur while programs running on your system try to open/read/write/delete a file. FileAccessErrorView displays the filename that the application tried to open/read/write/delete, the process id/name of the application, the error code (NTSTATUS code), the description of the error code, the number of times that this error occurred, and the timestamp of this error. DiskSmartView v1.21 DiskSmartView is a small utility that retrieves the S.M.A.R.T information (S.M.A.R.T = Self-Monitoring, Analysis, and Reporting Technology) from IDE disks. This information includes the disk model/firmware/serial number, cylinders/heads, power-on hours (POH), internal temperature, disk errors rate, and more. You can use the S.M.A.R.T information retrieved by DiskSmartView to find out whether there is any significant problem in your disk drive. AlternateStreamView v1.56 AlternateStreamView is a small utility that allows you to scan your NTFS drive, and find all hidden alternate streams stored in the file system. After scanning and finding the alternate streams, you can extract these streams into the specified folder, delete unwanted streams, or save the streams list into text/html/csv/xml file. AltStreamDump v1.05 AltStreamDump is a console application (Command Prompt) that dumps the list of NTFS alternate streams found in the current directory. By using a few command-line options, you can also instruct AltStreamDump to displays the alternate streams list of other folders and to scan subfolders in the desired folder depth NTFSLinksView v1.32 Starting from Windows Vista, Microsoft uses symbolic links and junction points of NTFS file system in order to make changes in the folders structure of Windows and keep the compatibility of applications written for older versions of Windows. This utility simply shows you to list of all symbolic links and junctions in the specified folder, and their target paths. FoldersReport v1.21 The FoldersReport utility scans a drive or a base folder that you select, and displays essential information for each folder that it finds: The size of all files inside the folder, The real files size on the disk, number of files inside the folder, number of hidden files, number of compressed files, and number of subfolders. You can use this utility to easily find out which folders use the most space in your drive. You can scan the folders of your local drives, CD-ROM drives, and network resources on a remote computer.

System Utilities

WinUpdatesView v1.13 - Windows Updates History Viewer WinUpdatesView is a simple tool that displays the history of Windows updates on your system. WinUpdatesView can load the Windows updates history from your local system, using API, and it can also read and parse the Windows updates database file (DataStore.edb) from external drive or from remote computer on your network. For every Windows update history record, WinUpdatesView displays the following fields: Title, Description, Install Date, Update Operation (Install, Uninstall, Not Started, In Progress), Operation Result (Succeeded, Succeeded With Errors, Failed, Aborted), Category, Information URL, Support URL, Uninstall Notes, Client Application ID, Service ID, Update ID, Revision Number, Unmapped Result Code, Server Selection, hResult MultiMonitorTool v1.96 MultiMonitorTool is a small tool that allows you to do some actions related to working with multiple monitors. With MultiMonitorTool, you can disable/enable monitors, set the primary monitor, save and load the configuration of all monitors, and move windows from one monitor to another. You can do these actions from the user interface or from command-line, without displaying user interface. MultiMonitorTool also provides a preview window, which allows you to watch a preview of every monitor on your system. ControlMyMonitor v1.26 ControlMyMonitor allows you view and modify the settings of your monitor (Also known as 'VCP Features'), like brightness, contrast, sharpness, red/green/blue color balance, and more... You can modify the monitor settings from the GUI and from command-line. You can also export all settings of your monitor into a configuration file and then later load the same configuration back into your monitor. PropertySystemView v1.11 PropertySystemView is a tool that allows you view and modify the properties of file from GUI and command-line, using the property system of Windows operating system. For example, you can change the 'Media Created' timestamp stored in .mp4 files (System.Media.DateEncoded) as well as other metadata stored in media files and office documents, like Title, Comments, Authors, Tags, Date Acquired, Last Saved Date, Content Created Date, Date Imported, Date Taken (EXIF of .jpg files), and more... PropertySystemView also allows you to set properties of Windows. For example, you can set the System.AppUserModel.ID property of a window in order to disable the taskbar grouping of the specified window. BlueScreenView v1.55 BlueScreenView scans all your minidump files created during 'blue screen of death' crashes, and displays the information about all crashes in one table. For each crash, BlueScreenView displays the minidump filename, the date/time of the crash, the basic crash information displayed in the blue screen (Bug Check Code and 4 parameters), and the details of the driver or module that possibly caused the crash (filename, product name, file description, and file version). For each crash displayed in the upper pane, you can view the details of the device drivers loaded during the crash in the lower pane. BlueScreenView also mark the drivers that their addresses found in the crash stack, so you can easily locate the suspected drivers that possibly caused the crash. USBDeview v2.86 USBDeview is a small utility that lists all USB devices that currently connected to your computer, as well as all USB devices that you previously used. For each USB device, extended information is displayed: Device name/description, device type, serial number (for mass storage devices), the date/time that device was added, VendorID, ProductID, and more... USBDeview also allows you to uninstall USB devices that you previously used, and disconnect USB devices that are currently connected to your computer. You can also use USBDeview on a remote computer, as long as you login to that computer with admin user. USBLogView v1.26 USBLogView is a small utility that runs in the background and records the details of any USB device that is plugged or unplugged into your system. For every log line created by USBLogView, the following information is displayed: Event Type (Plug/Unplug), Event Time, Device Name, Description, Device Type, Drive Letter (For storage devices), Serial Number (Only for some types of devices), Vendor ID, Product ID, Vendor Name, Product Name, and more... You can easily select one or more log records and then export them into csv/tab-delimited/xml/html file. UninstallView v1.37 UninstallView is a tool for Windows that collects information about all programs installed on your system and displays the details of the installed programs in one table. You can use it to get installed programs information for your local system, for remote computer on your network, and for external hard-drive plugged to your computer. It also allows you to easily uninstall a software on your local computer and remote computer (Including quiet uninstall if the installer supports it). InstalledAppView v1.01 InstalledAppView is a tool for Windows 10 that displays the details of Windows 10 apps installed on your system. For every Windows app, the following information is displayed: App Name, App Version, Registry Name, Registry Modified Time, Install Folder, Install Folder Owner, Uninstall Command, and more... InstalledAppView allows you to load the Windows 10 apps list from your local system, remote computer on your network and from external disk plugged to your computer. InstalledAppView also allows you to view the XML files of the Windows app (AppxManifest.xml and AppxBlockMap.xml), uninstall apps, quietly uninstall apps, open the install folder of the app, and more... InstalledPackagesView v1.05 InstalledPackagesView is a tool for Windows that displays the list of all software packages installed on your system with Windows Installer, and lists the files, Registry keys, and .NET Assemblies associated with them. For every installed software, the following information is displayed: Display Name, Display Version, Install Date, Registry Time, Estimated Size, Install Location, Install Source, MSI Filename (In C:\Windows\Installer), and more... You can watch the installed software packages information from your local system or from another system on external hard-drive. RegistryChangesView v1.25 RegistryChangesView is a tool for Windows that allows you to take a snapshot of Windows Registry and later compare it with another Registry snapshots, with the current Registry or with Registry files stored in a shadow copy created by Windows. When comparing 2 Registry snapshots, you can see the exact changes made in the Registry between the 2 snapshots, and optionally export the Registry changes into a standard .reg file of RegEdit. WinDefThreatsView v1.06 WinDefThreatsView is tool for Windows 10 that displays the list of all threats detected by Windows Defender Antivirus and allows you to easily set the default action (Allow, Quarantine, Clean, Remove, Block, or No Action) for multiple threats at once. You can use this tool on your local computer and also on remote computer, as long as you have permission to access WMI on the remote machine. WinCrashReport v1.25 WinCrashReport provides an alternative to the built-in crash reporting program of Windows operating system. When application crashes in your system and Windows displays the internal crash window of the operating system, you can run WinCrashReport, and get extensive report about the crashed application. The crash report of WinCrashReport is displayed as simple text or in HTML, and includes the following information: Crash memory address, Exception code, Exception description, Strings found in the stack, call stack, processor registers, modules list, threads list, and more... WhatIsHang v1.27 Sometimes, a Windows software hangs, the user interface doesn't respond anymore, and you cannot find out what is cause of the problem. This utility tries to detect the software that is currently hang, and displays some information that may allow you to understand what exactly cause the software to hang. Most of the information displayed in the report of WhatIsHang, like Call Stack, Stack Data, Processor Registers, and Memory Data, is designed for users with Windows programming knowledge. However, WhatIsHang also displays a list of strings and dll files related to the hang problem, which can also help users without programming knowledge to understand the cause of the problem. OpenedFilesView v1.86 OpenedFilesView displays the list of all opened files on your system. For each opened file, additional information is displayed: handle value, read/write/delete access, file position, the process that opened the file, and more... Optionally, you can also close one or more opened files, or close the process that opened these files. FolderChangesView v2.31 FolderChangesView is a simple tool that monitors the folder or disk drive that you choose and lists every filename that is being modified, created, or deleted while the folder is being monitored. You can use FolderChangesView with any local disk drive or with a remote network share, as long as you have read permission to the selected folder. AdvancedRun v1.21 AdvancedRun is a simple tool for Windows that allows you to run a program with different settings that you choose, including - low or high priority, start directory, main window state (Minimized/Maximized), run the program with different user or permissions, Operating system compatibility settings, and environment variables. You can also save the desired settings into a configuration file and then run the program automatically from command-line with the desired settings. ShadowCopyView v1.10 ShadowCopyView is simple tool for Windows 10/8/7/Vista that lists the snapshots of your hard drive created by the 'Volume Shadow Copy' service of Windows. Every snapshot contains an older versions of your files and folders from the date that the snapshot was created, you can browse the older version of your files and folders, and optionally copy them into a folder on your disk. PreviousFilesRecovery v1.00 PreviousFilesRecovery is a simple tool for Windows 10/8/7/Vista that allows you to scan the shadow copies of your local hard drive and find deleted files as well as older versions of existing files. If the file you need is found in the shadow copies of Windows, you can easily recover it by copying it into existing folder on your drive. LastActivityView v1.35 LastActivityView is a tool for Windows operating system that collects information from various sources on a running system, and displays a log of actions made by the user and events occurred on this computer. The activity displayed by LastActivityView includes: Running .exe file, Opening open/save dialog-box, Opening file/folder from Explorer or other software, software installation, system shutdown/start, application or system crash, network connection/disconnection and more... You can easily export this information into csv/tab-delimited/xml/html file or copy it to the clipboard and then paste into Excel or other software. OpenSaveFilesView v1.15 OpenSaveFilesView is a simple tool that displays the list of files that you previously opened with the standard open/save dialog-box of Windows. For every file in the list, the following information is displayed: Filename, Extension, Order (The order that the files were opened for every file extension), Open Time (Available only for the last opened file of every file type), File Modified/Created Time, File Size, and File Attributes. ExecutedProgramsList v1.11< ExecutedProgramsList is a simple tool that displays a list of programs and batch files that you previously executed on your system. For every program, ExecutedProgramsList displays the .exe file, the created/modified time of the .exe file, and the current version information of the program (product name, product version, company name) if it's available. For some of the programs, the last time execution time of the program is also displayed. TaskSchedulerView v1.54 TaskSchedulerView is a simple tool for Windows Vista/7/8/10 that displays in a single table the list of all tasks from the Task Scheduler of Windows. It also allows you to easily disable/enable mutiple tasks at once. For every task, the following information is displayed: Task Name, Description, Status, Hidden (Yes/No), Last Run/Next Run Times, Task Folder, EXE filename or COM handler of the task, number of missed runs, and more... LoadedDllsView v1.01 LoadedDllsView is a simple tool for Windows that scans all running processes on your system and displays the list of all DLL files loaded by these processes and the number of processes that load each DLL in the list. When selecting a DLL file in the upper pane of LoadedDllsView, the lower pane displays the list of all processes that use the selected DLL file. You can also select one or more DLL files and then export the list into comma-delimited/tab-delimited/html/xml file. TimeZonesView v1.06 TimeZonesView is a simple tool for Windows that displays all world time zones. For every time zone, the following information is displayed: name, description, current date/time in this time zone and date/time that daylight saving time begins and ends. SecuritySoftView v1.00 SecuritySoftView is a simple tool that displays the AntiVirus, AntiSpyware, and Firewall programs that are currently installed on your system and registered with the security center of Windows operating system. FolderTimeUpdate v1.55 FolderTimeUpdate is a simple tool for Windows that scans all files and folders under the base folder you choose, and updates the 'Modified Time' of every folder according the latest modified time of the files stored in it. This tool might be useful if, for example, you backup a cluster of folders and then restore them into another disk, but the backup program doesn't restore the original modified time of the folders. SimpleWMIView v1.40 SimpleWMIView is a simple tool for Windows that displays the result of WMI queries in a simple table, and allows you to easily export the data to text/csv/tab-delimited/html/xml file, or to copy the selected items to the clipboard and then paste them to Excel or other spreadsheet application. With SimpleWMIView you can get extensive information about your system, like a list of running processes, services, drivers, user accounts, hardware, and so on... AppCompatibilityView v1.02 AppCompatibilityView is a simple tool that displays the list of all programs that run with different compatibility settings, stored in the Registry under HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers keys. It also allows you to easily modify or delete the compatibility settings of multiple applications at once. AllThreadsView v1.00 AllThreadsView is a simple tool for Windows that displays a list of all running threads from all processes on your system in one table. For every thread, the following information is displayed: Thread ID, Creation Time, Kernel Time, User Time, Duration, Start Address, Priority, Base Priority, Context Switch Count, Context Switch Change (Since the last refresh), Wait Reason, Process ID, Process Path. MMCSnapInsView v1.00 MMCSnapInsView is a simple tool for Windows that displays the details of all MMC snap-ins installed on your system, including name, description, CLSID, dll file, product name, company name, file version, and more... You can also select multiple MMC snap-ins and then open them in MMC application. JumpListsView v1.16 JumpListsView is a simple tool that displays the information stored by the 'Jump Lists' feature of Windows 7 and Windows 8. For every record found in the Jump Lists, the following information is displayed: The filename that the user opened, the date/time of the file opening event, the ID of the application that was used to open the file, the size/time/attributes of the file on the time that the file was opened, and more... You can also export the Jump Lists records to csv/tab-delimited/xml/html file. SysExporter v1.77 SysExporter utility allows you to grab the data stored in standard list-views, list boxes, and combo boxes from almost any application running on your system, and export it to text, HTML or XML file. FirmwareTablesView v1.01 FirmwareTablesView is a simple tool for Windows that displays a list of firmware tables (ACPI, SMBIOS) stored on your system. You can view the content of these tables in Hex-dump format and export them to a binary file. BatteryInfoView v1.23 BatteryInfoView is a small utility for laptops and netbook computers that displays the current status and information about your battery. The displayed battery information includes the battery name, manufacture name, serial number, manufacture date, power state (charging/discharging), current battery capacity, full charged capacity, voltage, charge/discharge rate, and more... BatteryInfoView also provides a log window, which adds a new log line containing the battery status every 30 seconds or any other time interval that you choose. Password Security Scanner v1.60 This utility scans the passwords stored by popular Windows applications (Microsoft Outlook, Internet Explorer, Mozilla Firefox, and more...) and displays security information about all these passwords. The security information of every stored password includes the total number of characters, number of numeric characters, number of lowercase/uppercase characters, number of repeating characters, and password strength. You can use this tool to determine whether the passwords used by other users are secured enough, without watching the passwords themselves. WhatInStartup v1.35 This utility displays the list of all applications that are loaded automatically when Windows starts up. For each application, the following information is displayed: Startup Type (Registry/Startup Folder), Command-Line String, Product Name, File Version, Company Name, Location in the Registry or file system, and more. It allows you to easily disable or delete unwanted programs that run in your Windows startup. You can use it on your currently running instance of Windows, as well as you can use it on external instance of Windows in another drive. WhatInStartup also supports a special "Permanent Disabling" feature - If a program that you previously disabled added itself again to the startup list of Windows, WhatInStartup will automatically detect the change and disable it again. DevManView v1.67 DevManView is an alternative to the standard Device Manager of Windows, which displays all devices and their properties in flat table, instead of tree viewer. In addition to displaying the devices of your local computer, DevManView also allows you view the devices list of another computer on your network, as long as you have administrator access rights to this computer. DevManView can also load the devices list from external instance of Windows and disable unwanted devices. This feature can be useful if you have Windows operating system with booting problems, and you want to disable the problematic device. NetworkInterfacesView v1.21 NetworkInterfacesView is a simple tool that displays the list of all network adapters/interfaces installed on your system. It displays network interfaces that are currently active, as well as network interfaces that have been installed previously, and now they are not connected (like USB wireless network adapters). For every network interface found on your system, the following information is displayed (if it's stored in the Registry): Device Name, Connection Name, IP Address, Subnet Mask, Default Gateway, DHCP Server, Status, MAC Address and more... You can select one or more network interface items and then export them to xml/html/csv/tab-delimited file, or copy them into the clipboard and then paste them into Excel or other spreadsheet application. WinPrefetchView v1.36 Each time that you run an application in your system, a Prefetch file which contains information about the files loaded by the application is created by Windows operating system. The information in the Prefetch file is used for optimizing the loading time of the application in the next time that you run it. WinPrefetchView is a small utility that reads the Prefetch files stored in your system and displays the information stored in them. By looking in these files, you can learn which files every application is using, and which files are loaded on Windows boot. AppCrashView v1.35 AppCrashView is a small utility for Windows Vista and Windows 7 that displays the details of all application crashes occurred in your system. The crashes information is extracted from the .wer files created by the Windows Error Reporting (WER) component of the operating system every time that a crash is occurred. AppCrashView also allows you to easily save the crashes list to text/csv/html/xml file. ProcessActivityView v1.16 ProcessActivityView creates a summary of all files and folders that the selected process tries to access. For each file that the process access, the following information is displayed: Number of times that the file was opened and closed, number of read/write calls, total number of read/write bytes, the dll that made the last open-file call, and more... WinUpdatesList v1.33 WinUpdatesList displays the list of all Windows updates (Service Packs and Hotfixes) installed on your local computer. For hotfix updates, this utility also displays the list of files updated with these hotfixes. In addition, it allows you to instantly open the Web link in Microsoft Web site that provides more information about the selected update, uninstall an update, copy the update information to the clipboard, or save it to text/HTML/XML file. TurnedOnTimesView v1.42 TurnedOnTimesView is a simple tool that analyses the event log of Windows operating system, and detects the time ranges that your computer was turned on. For every period of time that the computer was turned on, the following information is displayed: Startup Time, Shutdown Time, Duration, Shutdown Reason, Shutdown Type, Shutdown Process, and Shutdown Code. TurnedOnTimesView allows you to get this information from your local computer, and from remote computer on your network if you have enough privilege to read the event log of Windows remotely. WinLogOnView v1.33 WinLogOnView is a simple tool for Windows Vista/7/8/2008 that analyses the security event log of Windows operating system, and detects the date/time that users logged on and logged off. For every time that a user log on/log off to your system, the following information is displayed: Logon ID, User Name, Domain, Computer, Logon Time, Logoff Time, Duration, and network address. WinLogOnView also allows you to easily export the logon sessions information to tab-delimited/comma-delimited/html/xml file. ShellExView v2.01 - Shell Extensions Manager The ShellExView utility displays the details of shell extensions installed on your computer, and allows you to easily disable and enable each shell extension. InstalledDriversList v1.05 InstalledDriversList is a simple tool for Windows that lists all device drivers that are currently installed on your system. For every device driver, the following information is displayed: Driver Name, Display Name, Description, Startup Type, Driver type, Driver Group, Filename, File Size, Modified/Created Time of the driver file, and version information of the driver file. If the driver is currently running on Windows kernel, the following information is also displayed: Base Memory Address, End Address, Memory Size, and Load Count. URLProtocolView v1.15 URLProtocolView is a simple utility that displays all URL protocols (for example: ftp:, telnet:, mailto:) that are currently installed on your system. For each URL protocol, the following information is displayed: The protocol name, the protocol description, the command-line that is executed when you type or click the URL, the product name, and the company name. This utility also allows you to easily enable/disable the URL protocols. WinsockServicesView v1.00 This utility displays the details of all Winsock service providers installed on your system. For every Winsock service, the following information is displayed: Display Name, Status (Enabled/Disabled), DLL Type (32-bit or 64-bit), DLL Filename, DLL Description/Version, and Created/Modified Time. WinsockServicesView also allows you to easily disable/enable a Winsock service provider. RegScanner v2.51 RegScanner is a small utility that allows you to scan the Registry, find the desired Registry values that match to the specified search criteria, and display them in one list. After finding the Registry values, you can easily jump to the right value in RegEdit, simply by double-clicking the desired Registry item. OfflineRegistryFinder v1.11 OfflineRegistryFinder is a tool for Windows that allows you to scan Registry files from external drive and find the desired Registry keys/values/data according to the search criteria you define. After OfflineRegistryFinder displays the search result, you can easily select one or more items and then export them into a .reg file that can be used to import in the RegEdit tool of Windows. OfflineRegistryFinder can also be used for Registry scan of your running operating system. You simply have to create a Registry snapshot, and then scan this snapshot with OfflineRegistryFinder. Searching in a Registry snapshot is usually much faster then searching in the Registry of running system. OfflineRegistryView v1.03 OfflineRegistryView is a simple tool for Windows that allows you to read offline Registry files from external drive and view the desired Registry key in .reg file format. RegFromApp v1.33 RegFromApp monitors the Registry changes made by the application that you selected, and creates a standard RegEdit registration file (.reg) that contains all the Registry changes made by the application. You can use the generated .reg file to import these changes with RegEdit when it's needed. BluetoothLogView v1.12 BluetoothLogView is a small utility that monitors the activity of Bluetooth devices around you, and displays a log of Bluetooth devices on the main window. Every time that a new Bluetooth device arrives to your area and when the device leaves your area, a new log line is added with the following information: Device Name, Device Address, Event Time, Event Type ('Device Arrival' or 'Device Left'), Device Type, and the company that created the device. BluetoothLogView also allows you to specify a description for every device (according to its MAC address) that will appear under the 'Description' column. BluetoothView v1.66 BluetoothView is a small utility that runs in the background, and monitor the activity of Bluetooth devices around you. For each detected Bluetooth device, it displays the following information: Device Name, Bluetooth Address, Major Device Type, Minor Device Type, First Detection Time, Last Detection Time, and more. BluetoothView can also notify you when a new Bluetooth device is detected, by displaying a balloon in your taskbar or by playing a small beep sound. ProcessThreadsView v1.29 ProcessThreadsView is a small utility that displays extensive information about all threads of the process that you choose. The threads information includes the ThreadID, Context Switches Count, Priority, Created Time, User/Kernel Time, Number of Windows, Window Title, Start Address, and more. When selecting a thread in the upper pane, the lower pane displays the following information: Strings found in the stack, stack modules addresses, call stack, and processor registers. ProcessThreadsView also allows you to suspend and resume one or more threads. CleanAfterMe v1.37 CleanAfterMe allows you to easily clean files and Registry entries that are automatically created by the Windows operating system during your regular computer work. With CleanAfterMe, you can clean the cookies/history/cache/passwords of Internet Explorer, the 'Recent' folder, the Registry entries that record the last opened files, the temporary folder of Windows, the event logs, the Recycle Bin, and more. SearchFilterView v1.00 When you search the content of files with Windows search, it uses the right search IFilter plugin according to the file extension. This utility allows you to easily view the search filters installed on your system and the file extensions that are associated with them, as well as it allows you to easily add or remove file extensions for these filters. UserProfilesView v1.10 UserProfilesView displays the list of all user profiles that you currently have in your system. For each user profile, the following information is displayed: Domain\User Name, Profile Path, Last Load Time, Registry File Size, User SID, and more. You can save the profiles list into text/xml/html/csv file. MonitorInfoView v1.22 MonitorInfoView is a small utility that displays essential information about your monitor: manufacture week/year, monitor manufacturer, monitor model, supported display modes, and more... The information is extracted from the EDID ("Extended display identification data") records stored on your computer. You can also view the monitor information of multiple computers on your network, if you login to these computers with administrator rights. RunAsDate v1.37 RunAsDate is a small utility that allows you to run a program in the date and time that you specify. This utility doesn't change the current system date and time of your computer, but it only injects the date/time that you specify into the desired application. You can run multiple applications simultaneously, each application works with different date and time, while the real date/time of your system continues to run normally. ProduKey v1.93 ProduKey is a small utility that displays the ProductID and the CD-Key of MS-Office, Windows, and SQL Server installed on your computer. You can view this information for your current running operating system, or for another operating system/computer - by using command-line options. RegDllView v1.60 RegDllView is a small utility that displays the list of all registered dll/ocx/exe files (COM registration). For each registered file, you can view the last date/time that it was registered, and the list of all registration entries (CLSID/ProgID). MUICacheView v1.01 Each time that you start using a new application, Windows operating system automatically extract the application name from the version resource of the exe file, and stores it for using it later, in Registry key known as the 'MuiCache'.

This utility allows you to easily view and edit the list of all MuiCache items on your system. You can edit the name of the application, or alternatively, you can delete unwanted MUICache items. ShellBagsView v1.30 Each time that you open a folder in Explorer, Windows automatically save the settings of this folder into the Registry. This utility displays the list of all folder settings saved by Windows. For each folder, the following information is displayed: The date/time that you opened it, the entry number, display mode (Details, Icons, Tiles, and so on...), the last position of the window, and the last size of the window. UserAssistView v1.02 This utility decrypt and displays the list of all UserAssist entries stored under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist key in the Registry. The UserAssist key contains information about the exe files and links that you open frequently. you can save the list of UserAssist entries into text/html/xml/csv file, as well as you can delete unwanted items. FullEventLogView v1.52 FullEventLogView is a simple tool for Windows 10/8/7/Vista that displays in a table the details of all events from the event logs of Windows, including the event description. It allows you to view the events of your local computer, events of a remote computer on your network, and events stored in .evtx files. It also allows you to export the events list to text/csv/tab-delimited/html/xml file from the GUI and from command-line. EventLogChannelsView v1.26 EventLogChannelsView is a simple tool for Windows 10/8/7/Vista that shows the list of all event log channels on your system, including the channel name, event log filename, enabled/disabled status, current number of events in the channel, and more... It also allows you to easily make some actions on multiple channels at once: enable/disable channels, set their maximum file size, and clear all events stored in the channels. MyEventViewer v2.25 MyEventViewer is a simple alternative to the standard event viewer of Windows. As oppose to Windows event viewer, MyEventViewer allows you to watch multiple event logs in one list, as well as the event description and data are displayed in the main window, instead of opening a new one. Also, with MyEventViewer you can easily select multiple event items and then save them to HTML/Text/XML file, or copy them to the clipboard (Ctrl+C) and then paste them into Excel. EventLogSourcesView v1.00 EventLogSourcesView is a simple tool that displays the list of all event log sources installed on your system. For every event log source, the following information is displayed: Event Source Name, Event Type, DLL/EXE Files containing the event message strings, Registry Modified Time, and version information taken from the DLL/EXE file (Product Name, Company, File Description, File Version) ActiveXHelper v1.12 ActiveXHelper is a small utility that allows you to view essential information about ActiveX components installed on your computer. You can view the entire (and very large !) list of ActiveX components by loading it from HKEY_CLASSES_ROOT\CLSID Registry key, or alternatively, display only the ActiveX components that you specify. In addition, you can temporarily disable specific ActiveX components. When ActiveX components are disabled, they cannot be used by any software, until you enable them again. RecentFilesView v1.33 Each time that you open a file from Windows Explorer or from a standard open/save dialog-box, the name of the file that you opened is recorded by the operating system. Some of the names are saved into the 'Recent' folder. Other are saved into the Registry. This utility display the list of all recently opened files, and allows you to delete unwanted filename entries. You can also save the files list into text/html/xml file. InjectedDLL v1.00 InjectedDLL is a small utility that displays the list of DLLs that are automatically injected on every process in your system. CurrProcess v1.13 CurrProcess utility displays the list of all processes currently running on your system. For each process, you can view the list of all modules (DLL files) that the process loads into memory. for all processes and modules, additional useful information is also displayed: product name, version, company name, description of the file, the size of the file, and more. In addition, CurrProcess allows you to do the following actions: Kill a process, Dump memory of process into a text file, Create HTML report containing information about a process with the list of all modules that it loads into memory, Save the list of all running processes into text or HTML file, and more. ServiWin v1.71 ServiWin utility displays the list of installed drivers and services on your system. For some of them, additional useful information is displayed: file description, version, product name, company that created the driver file, and more. In addition, ServiWin allows you to easily stop, start, restart, pause, and continue service or driver, change the startup type of service or driver (automatic, manual, disabled, boot or system), save the list of services and drivers to file, or view HTML report of installed services/drivers in your default browser. ShellMenuView v1.41 ShellMenuView is a small utility that display the list of static menu items that appeared in the context menu when you right-click a file/folder on Windows Explorer, and allows you to easily disable unwanted menu items. ShellMenuNew v1.02 ShellMenuNew is a small utility that displays the list of all menu items in the 'New' submenu of Windows Explorer. It allows you to easily disable unwanted menu items, so this 'New' submenu will display only the items that you need. BulkFileChanger v1.71 BulkFileChanger is a small utility that allows you to create files list from multiple folders, and then make some action on them - Modify their created/modified/accessed time, change their file attribute (Read Only, Hidden, System), run an executable with these files as parameter, and copy/cut paste into Explorer. DriverView v1.47 DriverView utility displays the list of all device drivers currently loaded on your system. For each driver in the list, additional useful information is displayed: load address of the driver, description, version, product name, company that created the driver, and more. KeyboardStateView v1.00 KeyboardStateView is a simple tool for Windows that displays the current state and virtual key code of every key you press. It also allows you to view the current state of all keyboard keys. For every key, the following information is displayed: Key Name (VK_XXXX ), Description, Key Code (Decimal), Key Code (Hexadecimal), Key Pressed Status, Key Toggled Status (Useful for Num Lock, Caps Lock), and last time that the key was pressed. HandleCountersView v1.00 HandleCountersView is a simple tool for Windows that shows the current number of handles (File, Directory, Token, Job, Thread, and so on...) opened by every process running on your system and the change in number of handles since the last time that you reset the counters. GACView v1.11 GACView is an alternative to the standard .NET assembly viewer on Windows Explorer. In addition to the standard columns, GACView displays additional information for each assembly, like modified date, file size, full path of the assembly file, file version, and so on. GACView also allows you to delete an assembly the cannot be uninstalled in the regular way. IECompo v1.00 Displays the installed Internet Explorer components on your computer. StartBlueScreen v1.00 This utility, just as it sounds, allows your to crash the Windows operating system by initiating a Blue Screen of Death according to 5 parameters that you specify from command-line.

Other Utilities

• MobileFileSearch
  MobileFileSearch is a tool for Windows that allows you to search files inside a mobile device (Smartphone or Tablet) plugged to the USB port on your computer, with Media Transfer Protocol (MTP). You can search files by their size, their created time, their modified time, or their name (using wildcard). After finding the files on your Smartphone / Tablet, you can optionally delete them, copy them to a folder on your computer, or export the files list to csv/tab-delimited/html/xml/JSON file. MobileFileSearch also allows you to activate the search from command-line and then export the result to a file, or copy the found files to the desired folder on your computer.

• ESEDatabaseView
  ESEDatabaseView is a simple utility that reads and displays the data stored inside Extensible Storage Engine (ESE) database (Also known as 'Jet Blue' or .edb file). It displays a list of all tables available in the opened database file, allows you to choose the desired table to view, and then when you choose a table, it displays all records found in the selected table. ESEDatabaseView also allows you to easily choose one or more records, and then export them into comma-delimited/tab-delimited/html/xml file, or copy the records to the clipboard (Ctrl+C) and then paste them into Excel or other spreadsheet application.

• WebCamImageSave
  WebCamImageSave is simple WebCam capture utility that allows you to easily capture a still image from your camera every number of seconds that you choose, and save it into image file (.jpg, .png, .bmp) on your disk. You can format the saved image filename with the date/time that the image was taken according to your preference, for example: c:\images\img20110725_123256.jpg WebCamImageSave also adds a label with the date/time that the image was captured into the image, by using the font, color, and date/time format that you choose. You can also capture a single camera image from command-line, without displaying any user interface.

• ExifDataView
  ExifDataView is a small utility that reads and displays the Exif data stored inside .jpg image files generated by digital cameras. The EXIF data includes the name of the company created the camera, camera model, the date/time that the photograph was taken, Exposure Time, ISO Speed, GPS information (for digital cameras with GPS), and more. TableTextCompare v1.20 TableTextCompare is a small utility that allows you to easily compare 2 tab-delimited or comma-delimited (csv) files, and find out the difference between the 2 files. You can use this tool for comparing 2 different snapshots of data, created by other NirSoft utilities, like DriverView, ServiWin, USBDeview, CurrPorts, WirelessNetView, ShellExView, and many others... For example, You can use DriverView utility to save 2 snapshots of loaded drivers list into a tab-delimited file, and then use TableTextCompare to easily find out which device drivers were added, removed, or changed since the time that the first snapshot was taken. TableTextCompare can make the comparison even if the records of the 2 files are not sorted in the same order, or if the fields are not positioned in the same order. CSVFileView v2.45 CSVFileView is a simple CSV file viewer/converter utility that allows you to easily view the content of CSV or tab-delimited file created by NirSoft utilities or by any other software, in a simple table viewer. You can sort the lines according to one of the fields, remove unwanted fields and change their order, and then save the result back into CSV file, tab-delimited file, XML file, or HTML report. LiveContactsView v1.26 LiveContactsView is a small utility that allows you to view the details of all contacts in your Windows Live Messenger. For each contact, LiveContactsView display the following fields: Email address, nickname, quick name, first name, last name, and more. You can easily select one or more contacts and then export them into text/xml/html/csv file, or copy them into the clipboard and then paste them into Excel or to other spreadsheet application. SkypeLogView v1.55 SkypeLogView reads the log files created by Skype application, and displays the details of incoming/outgoing calls, chat messages, and file transfers made by the specified Skype account. You can select one or more items from the logs list, and then copy them to the clipboard, or export them into text/html/csv/xml file. SkypeContactsView v1.05 SkypeContactsView is a simple tool that displays the list of all Skype contacts stored in the local database file of Skype. For each contact, one or more of the following fields are displayed: Skype Name, Full Name, Display Name, Gender, ID, Birthday, Profile Time, Last Online Time, Last Used Time, Phone, Emails, and more... SkypeContactsView also allows you to export the contacts list into text/tab-delimited/comma-delimited/xml/html file, or copy them to the clipboard and then paste them into Excel or other spreadsheet application. ResourcesExtract v1.18 ResourcesExtract is a small utility that scans dll/ocx/exe files and extract all resources (bitmaps, icons, cursors, AVI movies, HTML files, and more...) stored in them into the folder that you specify. You can use ResourcesExtract in user interface mode, or alternatively, you can run ResourcesExtract in command-line mode without displaying any user interface. HashMyFiles v2.36 HashMyFiles is small utility that allows you to calculate the MD5 and SHA1 hashes of one or more files in your system. You can easily copy the MD5/SHA1 hashes list into the clipboard, or save them into text/html/xml file. HashMyFiles can also be launched from the context menu of Windows Explorer, and display the MD5/SHA1 hashes of the selected file or folder. WinFontsView v1.10 WinFontsView is a small utility that enumerates all fonts installed on your system, and display them in one simple table. For each font, WinFontsView draws 5 samples of the font in different sizes, in order to allow you to easily find and choose the desired font that you need. WinFontsView also allows you to view the fonts as Bold, as Italic or with underline, as well as it allows you to export the fonts list into html file. If you need to find a font in non-English character set, WinFontsView also allows you to choose the right characters set of the fonts and to type the characters displayed in the sample text of each font. HotKeysList v1.05 HotKeysList is a simple tool for Windows that displays the list of hot keys that are currently registered on your system. You can use this tool to easily determine which hot keys on your system are available to use. MetarWeather v1.76 The MetarWeather utility decodes METAR weather reports from around the world, and displays them in a simple weather report table. You can save the weather report into a text or HTML files. MetarWeather can decode METAR reports from a text file, or download the latest reports directly from the Internet. HtmlDocEdit v1.02 HtmlDocEdit is a simple HTML designer/editor based on the Internet Explorer browser, that allows you to easily edit HTML files without any knowledge in HTML. With HtmlDocEdit you can change the font/color of selected text, add images, add links, add ordered and unordered lists, and more... ZipInstaller v1.21 The ZipInstaller utility installs and uninstalls applications and utilities that do not provide an internal installation program. You can use this utility to install and uninstall all other utilities in this Web site. IconsExtract v1.47 Extract icons and cursors from EXE, DLL, CPL, and OCX files and save them as ICO or CUR files. DotNetResourcesExtract v1.01 DotNetResourcesExtract is a small utility that scan dll/exe files of .NET applications, and extract all .NET embedded resources (Bitmaps, Gifs, HTML files, and so on) stored in them into the folder that you specify. c# source code is available. WinExplorer v1.30 WinExplorer is a utility that shows all system's windows in hierarchical display. For every window in the hierarchy, you can view its properties, like handle, class name, caption, size, position and more. You can also modify some properties, like Caption and Visible/Enable. Source code is included

ExeInfo v1.01 The ExeInfo utility shows general information about executable files (.exe), dynamic-link libraries (.dll), ocx files, and drivers files.

Source code is included pcANYWHERE Hosts Scanner v1.01 This small utility allows you to scan a TCP/IP network and get the list of all pcANYWHERE hosts within that network. The Visual Basic source code is included !

1. Logiciels d’investigation numérique : a. Logiciels strictement d’investigation numérique : i. FTKi (FTK Imager) : · Fabricant : Access Data, version réduite de FTK (2500$US) · Avantages : Montage rapide et création/conversion d’image · Inconvénients : Affichage non récursif et limites « display » Ouvrir une image Convertir une image Obtain protected files Recherche RegEx Image mounting Create Disk Image Fonctionnalités à tester Fichiers affichables Capture memory Barre statut Export File, Hash, Directory Reset docked window Systèmes de fichiers chargeables Imager Custom et Path restore Volet combiné – Properties, Hex Int, Custom, Copy Volet affichage – Navigation et Copy… 12 Tableau 2410-3 - Sommaire des fonctionnalités importantes de FTK Imager ii. EnFI (Encase Forensic Imager) : · Fabricant : Guidance Soft., vers. réduite Encase (2500$US) · Avantages : Montage rapide et affichage récursif · Inconvénients : Non forensique et pas de clonage « Add… » device, File, Image Détection de bloqueurs Restore Create LEF et Acquire Fonctions de tri et d’affichage Physical et Process Memory Crossover (bootfloppy vient avec une licence régulière) Scan Disk config & LVM Device – Time zone settings et Hash Generate Encryption Key 13 Tableau 2410-4 - Sommaire des fonctionnalités importantes de Encase Forensic Imager iii. Autopsy : · Fabricant : The Sleuth Kit et Brian Carrier · Avantages : Gratuit, indexation, regex · Inconvénients : Pas d’affichage récursif Search by attributes Timeline Search by MD5 Results Keyword parser : regex, list, string Hash lookup Generate report Tags 14 Tableau 2410-5 - Sommaire des fonctionnalités importantes de Autopsy TSK Notes d’investigation numérique 2410 – Matériel et logiciels d’opération et de laboratoire 62 Version 2020d : 2 mai 2020 iv. DFF (Digital Forensic Framework) : · Fabricant : Arxsys (groupe français) · Avantages : Affichage récursif, regex, filtres · Inconvénients : Moins convivial, faiblesse NTFS Open evidence/device Bookmarks Sélection Affichage récursif Filtres vs Search Search Open with…Viewers…Statistics… Timeline et Filechart Tags 15 Tableau 2410-6 - Sommaire des fonctionnalités importantes de DFF v. HxD : · Fabricant : Maël Hörz · Avantages : Léger, lit disque RAM et image forensiquement · Inconvénients : Pas d’affichage d’arborescence Find…text, hex, int Wipe securely File compare Select Block Open…Disk, RAM, Logical Go To…offset Checksums 16 Tableau 2410-7 - Sommaire des fonctionnalités importantes de HxD vi. WinHex : · Fabricant : Stefan Fleischmann · Avantages : Richesse des fonction. Fait pour la forensique. · Inconvénients : Aucun. Renouvellement de licences ? ? ? Open Disk…RAM File Tools, Disk tools Effacer un bloc Navigation Profusion de fonctions et d’outils 17 Tableau 2410-8 - Sommaire des fonctionnalités importantes de WinHex b. Logiciels utilitaires : · FlexHex : Éditeur hexadécimal gratuit avec capacité de monter l’ensemble d’un média ou d’une partition en mémoire · HFS Explorer : Permet de naviguer sur HFS/HFS+ · Diskinternals : Permettent de naviguer sur HFS/HFS+, Ext#FS, Reiser, NTFS, FAT# et exFAT, formats courants de disques virtuels · Audacity et Gimp : Logiciels audio et images · dcode : Conversion de dates hexadécimales en format intelligible · Double commander : Gestion de fichier et de répertoires. Multiples plugins vers objets étranges. Notamment plugin Diskinternals, 7zip, Amiga, ISO. · Quick Hash : Empreinte numérique de texte, fichier(s), disque, partition. Copie « hashée ». Comparaison de répertoire. · Virtual Box : Hyperviseur type 2 pouvant lire plusieurs formats de disques virtuels · 7zip : Compresseur/décompresseur de fichier · Google Earth : Permet de « voir » les lieux en mode carte, satellite ou « street view ». Très utile pour voir sans se déplacer · MobaLive CD : Pour exécuter un ISO comme si on l’avait gravé sur DVD et exécuté Notes d’investigation numérique 2410 – Matériel et logiciels d’opération et de laboratoire 63 Version 2020d : 2 mai 2020 c. Logiciels d’extraction/d’interprétation : i. Extracteurs d’informations (« Viewers ») : · Json viewer · Thumbs viewer · Plist Editor · MFT viewer · Nir Sofer Cookies Viewer · Foxton History Browser · USBdeView · USB device Forensics · Advd. Prefetch Analyzer · GeoSetter : Métadonnées de jpg · Graphical Engine NTFS · Windows events parser · Asterisk password unmask ii. Régénérateurs de corbeilles : · Info2 · VW7 iii. Lecteurs de base de registre : · FRED · WRR · YARU (TZWorks) iv. Lecteurs de base de données de courriels : · Mail Viewer · Kernel for Outlook to pdf · Outlook pst · Exchange Edb v. Divers : · Open/Libre office · Cute Pdf Writer vi. Extracteurs d’informations des processus : · TMX · PS Tools vii. Interpréteurs de mémoire vive : · Mandiant Memoryze · Volatility · Volix II