jschicht/ExtractUsnJrnl

Stars
104
Rank 330,604 (Top 7 %)
Language AutoIt
License
Other
Created about 10 years ago
Updated over 5 years ago

jschicht/ExtractUsnJrnl

jschicht

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Tool to extract the $UsnJrnl from an NTFS volume

RunAsTI

Launch processes with TrustedInstaller privilege

RawCopy

Commandline low level file extractor for NTFS

Mft2Csv

Extract $MFT record info and log it to a csv file.

LogFileParser

Parser for $LogFile on NTFS

UsnJrnl2Csv

Parser for $UsnJrnl on NTFS

SetMace

Manipulate timestamps on NTFS

EaTools

Analysis and manipulation of extended attribute ($EA) on NTFS

Indx2Csv

An advanced parser for INDX records

PowerMft

Powerful commandline $MFT record editor.

SectorIo

Kernel mode driver for writing to physical disk with SL_FORCE_DIRECT_WRITE

Secure2Csv

Decode security descriptors in $Secure on NTFS

NtfsFileExtractor

Extract files off NTFS

MftCarver

Carve $MFT records from a chunk of data (for instance a memory dump)

SetRegTime

Registry timestamp manipulation

HideAndProtect

Makes files super hidden on NTFS

NtSuspendProcess

Suspend and resume processes by using functions in ntdll.dll.

MftRcrd

Command line $MFT record decoder

StegoMft

PoC for hiding data within $MFT

IndxCarver

Carve INDX records from a chunk of data.

UsnJrnlCarver

Carving Usn pages (UsnJrnl records)

MyDiskEraser

How to make your own disk erasing boot cd.

NativeRegMod

A native application that can modify registry

RegKeyFixer

Dealing with certain invalid registry keys

RcrdCarver

Carve RCRD records ($LogFile) from a chunk of data.

ProcessCritical

Manipulate ProcessBreakOnTermination in ProcessInfoClass on any process from command line

ExtractAllAttributes

Extracts all attributes of files on NTFS

MakeImage

Create graphic bitmap from binary data.

ExtractFromDataRun

Extract files from NTFS by run list

RemoveCertificate

Removes the authenticode digital signature (certificate) from an executable

MakeContainer

Tools to create special containers for patched VeraCrypt/TrueCrypt

Tiny_NTFS

Smallest possible size of a NTFS partition

HexDump

Dump binary data to console from file or disk

PartDump

Utility to dump basic volume information from a disk object.

RawDir

A low level dir command for NTFS volumes

Volsnap-Bug-Content

Content for a volsnap.sys bug analysis

VeraCrypt

Tweaked version for supporting arbitrary offsets.

GetProcAddressGUI

Retrieve shellcode formatted address of function from module

Binary2Bmp

Turn any file into a bmp