Clik here to view.
Registry hive basics part 4: SK records
In part 3, we covered VK records. Next up is the SK record, or Security KeySK recordAn SK (security key) record contains the information necessary to define access controls for the Registry. An example...
View ArticleClik here to view.
XWFIM and XWFRT v1.0 released!
XWFIM and XWFRT version 1.0 now available!XWFIM Changes include:NEW: Full proxy support via Tools menuNEW: Support for BYOD downloadsCHANGE: You can now make a portable installation on any device vs...
View ArticleClik here to view.
ShellBags Explorer v0.5.2.0 released!
Changes include:NEW: Detect deleted ShellBags. When deleted ShellBags are found they will have a red X after the name of the bag. Deleted ShellBags will also be denoted in the Miscellaneous columnNEW:...
View ArticleClik here to view.
Exploring the Registry at the hex level
If you want to open your hives and browse the structure you can of course use any hex editor. There are several hex editors out there that let you define templates to parse data. One of these hex...
View ArticleClik here to view.
Introducing Registry Explorer
Registry Explorer is a new approach to interacting with Registry hives. It has several unique capabilities not found in other programs.The version being discussed here is 0.0.1.8 (some of the...
View ArticleClik here to view.
ShellBags Explorer 0.5.4.0 released!
This release contains the following changes:CHANGE: Replace custom logging code with NLogFIX: A few cosmetic fixes to ShellBag details outputFIX: Registry parser bug fixes on some fringe casesThe...
View ArticleClik here to view.
Registry Explorer 0.0.2.0 released!
Lots of good changes in this version including:Known issues:- Large hives (SOFTWARE 100+ Mb) can be slow to load the tree due to the number of data in these hives (100s of thousands of keys and...
View ArticleThe end of XWFRT?
Starting with X-Ways Forensics 18.1, the report format generated by X-Ways Forensics was dramatically changed, breaking XWFRT.Today X-Ways Forensics 18.2 Beta 3 was released. One of the changes...
View ArticleClik here to view.
ShellBags Explorer 0.6.0.0 released!
This version contains the following changes:NEW: Added NodeSlot info. This column is hidden by default in the grid, but will always be shown in Details viewCHANGE: Updated Registry parser code (~150%...
View ArticleClik here to view.
AppCompatCache changes in Windows 10
The AppCompatCache value lives at SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache.In Windows 7, 8.0, and 8.1, the header is 128 bytes in size (more details here)I recently added...
View ArticleClik here to view.
Introducing AppCompatCacheParser
Yesterday I got a request to put together a utility to dump shimcache entries from the Registry. Today it is available!Windows 7 (x86 and x84), Windows 8.x (Server 2012* as well), and Windows 10 are...
View ArticleClik here to view.
AppCompatCacheParser v0.0.5.1 released
Changes include:NEW: Added CacheEntryPosition to allow for sorting in the order cache entries were found in the RegistryNEW: Changed format of last modified timestamp to allow for sorting. Format is...
View ArticleClik here to view.
AppCompatCacheParser v0.0.5.2 released
This version tweaks the format of the LastModifiedTimeUTC column so that it is in the form MM-dd-yyyy HH:mm:ss which allows for easy sorting and grouping in Excel.You can get the update here or via the...
View ArticleClik here to view.
ShellBags Explorer 0.6.1 released!
This version adds support for Windows XP hives. For the most part, things should "just work" with XP hives (NTUSER.DAT), but as you can see in the image below, there are some differences I need to work...
View ArticleClik here to view.
Introducing RECmd!
RECmd is a command line tool to access offline (for now, live Registry support is planned) hives.The command line options look like this:There are 3 categories of commands, General, Query, and...
View ArticleClik here to view.
RECmd 0.6.0.0 released!
This version adds some new features and a bit of polish. Changes include:New: Added --Sort that will sort the output according to the type of data returned (size for MinSize, time stamps for date range...
View ArticleClik here to view.
RECmd 0.6.1.0 released!
This version is mostly cleanup and slight formatting changes to make things easier to use.You can get the updated version here or on GithubChanges include:CHANGE: Clean up command line option language,...
View ArticleClik here to view.
Reintroducing Registry Explorer and RECmd!
I am happy to announce the availability of the next releases of Registry Explorer and RECmd! Extensive work has been done in a variety of areas which will be detailed below.This post serves to hit the...
View ArticleClik here to view.
Registry Explorer/RECmd 0.7.1.0 released!
This is the #DFIRSummit release!Several people asked for some tweaks such as recursively searching Registry hives via RECmd and allowing Registry Explorer to be set as the default application for...
View ArticleClik here to view.
Introducing bstrings, a Better Strings utility!
Do you like strings? Do you like to find strings? How about in binary data? What about via regular expressions?ME TOO!bstrings works like other strings utilities out there, but it also has some...
View Article
