161 tools

Windows Forensic Parsers and Tools

Every parser and tool referenced on this site, with its licence and the artifacts it handles. Open an artifact for how to use it.

Tool	Type	Artifacts
$LogFile Parser	In browser	$LogFile (NTFS transaction log)
Amcache Parser	In browser	Amcache.hve Installed Programs (Uninstall Keys, MSI, AppX) Kernel Drivers (.sys, Driver Services, BYOVD) Windows Subsystem for Linux (WSL)
BAM/DAM Parser	In browser	BAM / DAM (Background Activity Moderator)
Browser Forensics	In browser	Browser artifacts (Chrome, Edge, Firefox)
Disk Image Parser	In browser	$I30 index attributes $LogFile (NTFS transaction log) $Secure:$SDS security descriptors Master File Table ($MFT) Mounted Disk Images (ISO, IMG, VHD, VHDX) Registry hives USN Journal ($UsnJrnl:$J) Windows Subsystem for Linux (WSL)
EVTX Parser	In browser	BITS jobs (qmgr database) Bluetooth paired devices Group Policy artifacts Installed Programs (Uninstall Keys, MSI, AppX) Kernel Drivers (.sys, Driver Services, BYOVD) Microsoft Defender logs and quarantine Mounted Disk Images (ISO, IMG, VHD, VHDX) Network profiles (NetworkList) NTDS.dit and domain controllers OpenSSH Server and Client PowerShell logs and history Print spooler files (.SPL and .SHD) RDP connection artifacts Remote access tools (RMM) Scheduled Tasks Sysmon Event Log USB device history Windows Error Reporting (WER) Windows event logs (EVTX) Windows Firewall Logs Windows Services
Hash Extractor	In browser	—
Jump List Parser	In browser	Jump Lists Mounted Disk Images (ISO, IMG, VHD, VHDX)
LNK Parser	In browser	LNK shortcut files Mounted Disk Images (ISO, IMG, VHD, VHDX) Windows Subsystem for Linux (WSL)
Messaging Forensics	In browser	Desktop messaging apps (Slack, Signal, WhatsApp…) Microsoft Teams (classic and new client) Outlook data files (PST and OST)
MFT Parser	In browser	Master File Table ($MFT) Zone.Identifier (Mark of the Web)
Pagefile Parser	In browser	pagefile.sys and swapfile.sys
PCAP Parser	In browser	Remote access tools (RMM) Windows Firewall Logs
PE Parser	In browser	Kernel Drivers (.sys, Driver Services, BYOVD) PE files (Windows executables)
PowerShell Parser	In browser	PowerShell logs and history
Prefetch Parser	In browser	Mounted Disk Images (ISO, IMG, VHD, VHDX) Prefetch Files (.pf) Windows Subsystem for Linux (WSL)
RAM Parser	In browser	Crash dumps (MEMORY.DMP, minidumps) DPAPI and Credential Manager hiberfil.sys (hibernation file)
RDP Cache Parser	In browser	RDP bitmap cache
RecentFileCache Parser	In browser	RecentFileCache.bcf
Recycle Bin Parser	In browser	Recycle Bin
Registry Parser	In browser	BAM / DAM (Background Activity Moderator) Bluetooth paired devices CapabilityAccessManager (camera, mic, location) DPAPI and Credential Manager Group Policy artifacts IFEO and Winlogon persistence Installed Programs (Uninstall Keys, MSI, AppX) Kernel Drivers (.sys, Driver Services, BYOVD) Mounted Disk Images (ISO, IMG, VHD, VHDX) MUICache Network profiles (NetworkList) NTDS.dit and domain controllers Office MRU and Trust Records OpenSaveMRU and LastVisitedMRU Print spooler files (.SPL and .SHD) RDP connection artifacts RecentDocs Registry hives Remote access tools (RMM) Run keys and Startup folders RunMRU SAM hive and user accounts Syscache.hve TypedPaths and WordWheelQuery USB device history UserAssist Windows Services Windows Subsystem for Linux (WSL)
Scheduled Tasks Parser	In browser	Scheduled Tasks
SecretsDump	In browser	DPAPI and Credential Manager NTDS.dit and domain controllers SAM hive and user accounts
ShellBags Parser	In browser	ShellBags Windows Subsystem for Linux (WSL)
ShimCache Parser	In browser	ShimCache (AppCompatCache)
SRUM Parser	In browser	SRUM (System Resource Usage Monitor)
Thumbcache Parser	In browser	Thumbcache
USB Forensics	In browser	USB device history
USN Journal Parser	In browser	USN Journal ($UsnJrnl:$J)
Windows Notification Parser	In browser	Notification database (wpndatabase.db)
Windows Search Parser	In browser	Windows Search index
Windows Timeline Parser	In browser	Clipboard history Windows Timeline (ActivitiesCache.db)
WMI Parser	In browser	WMI repository and SCCM RecentlyUsedApps
Velociraptor	Platform · open source	$I30 index attributes $Secure:$SDS security descriptors Amcache.hve BAM / DAM (Background Activity Moderator) BITS jobs (qmgr database) Browser artifacts (Chrome, Edge, Firefox) CapabilityAccessManager (camera, mic, location) Clipboard history IFEO and Winlogon persistence IIS Web Server Logs Installed Programs (Uninstall Keys, MSI, AppX) Jump Lists Kernel Drivers (.sys, Driver Services, BYOVD) LNK shortcut files Master File Table ($MFT) Mounted Disk Images (ISO, IMG, VHD, VHDX) Notepad TabState (Windows 11) Notification database (wpndatabase.db) Office MRU and Trust Records OpenSSH Server and Client PowerShell logs and history Prefetch Files (.pf) RDP bitmap cache RDP connection artifacts RecentDocs Recycle Bin Registry hives Run keys and Startup folders RunMRU SAM hive and user accounts Scheduled Tasks ShellBags ShimCache (AppCompatCache) SRUM (System Resource Usage Monitor) Sysmon Event Log UserAssist USN Journal ($UsnJrnl:$J) Volume Shadow Copies (VSS) Windows Error Reporting (WER) Windows Firewall Logs Windows Recall (Copilot+ PC snapshots) Windows Services Windows Subsystem for Linux (WSL) Windows Timeline (ActivitiesCache.db) WMI repository and SCCM RecentlyUsedApps Zone.Identifier (Mark of the Web)
Registry ExplorerEric Zimmerman	GUI	Amcache.hve BAM / DAM (Background Activity Moderator) Bluetooth paired devices CapabilityAccessManager (camera, mic, location) Group Policy artifacts IFEO and Winlogon persistence Installed Programs (Uninstall Keys, MSI, AppX) Kernel Drivers (.sys, Driver Services, BYOVD) Mounted Disk Images (ISO, IMG, VHD, VHDX) MUICache Network profiles (NetworkList) Office MRU and Trust Records OneDrive sync client OpenSaveMRU and LastVisitedMRU Print spooler files (.SPL and .SHD) Program Compatibility Assistant (PCA) RDP connection artifacts RecentDocs Registry hives Run keys and Startup folders RunMRU SAM hive and user accounts Syscache.hve TypedPaths and WordWheelQuery USB device history UserAssist Windows Firewall Logs Windows Services Windows Subsystem for Linux (WSL)
RegRipper	CLI · open source	Amcache.hve BAM / DAM (Background Activity Moderator) Bluetooth paired devices Group Policy artifacts IFEO and Winlogon persistence Installed Programs (Uninstall Keys, MSI, AppX) MUICache Network profiles (NetworkList) Office MRU and Trust Records OpenSaveMRU and LastVisitedMRU Program Compatibility Assistant (PCA) RDP connection artifacts RecentDocs Registry hives Run keys and Startup folders RunMRU SAM hive and user accounts Scheduled Tasks ShellBags ShimCache (AppCompatCache) Syscache.hve TypedPaths and WordWheelQuery USB device history UserAssist Windows Services
EvtxECmdEric Zimmerman	CLI	BITS jobs (qmgr database) Bluetooth paired devices Installed Programs (Uninstall Keys, MSI, AppX) Kernel Drivers (.sys, Driver Services, BYOVD) Microsoft Defender logs and quarantine Mounted Disk Images (ISO, IMG, VHD, VHDX) OpenSSH Server and Client PowerShell logs and history Print spooler files (.SPL and .SHD) RDP connection artifacts Remote access tools (RMM) Scheduled Tasks Sysmon Event Log USB device history Windows Error Reporting (WER) Windows event logs (EVTX) Windows Firewall Logs Windows Services WMI repository and SCCM RecentlyUsedApps
RECmdEric Zimmerman	CLI	BAM / DAM (Background Activity Moderator) Bluetooth paired devices CapabilityAccessManager (camera, mic, location) IFEO and Winlogon persistence Network profiles (NetworkList) Office MRU and Trust Records OpenSaveMRU and LastVisitedMRU RecentDocs Registry hives Remote access tools (RMM) Run keys and Startup folders RunMRU TypedPaths and WordWheelQuery USB device history Windows Services
Plaso	CLI · open source	IFEO and Winlogon persistence Jump Lists LNK shortcut files Master File Table ($MFT) Notification database (wpndatabase.db) Recycle Bin Run keys and Startup folders Scheduled Tasks USN Journal ($UsnJrnl:$J) Windows Subsystem for Linux (WSL) Windows Timeline (ActivitiesCache.db)
DB Browser for SQLite	GUI · open source	Browser artifacts (Chrome, Edge, Firefox) CapabilityAccessManager (camera, mic, location) Clipboard history Notification database (wpndatabase.db) OneDrive sync client Sticky Notes (plum.sqlite and StickyNotes.snt) Windows Recall (Copilot+ PC snapshots)
MFTECmdEric Zimmerman	CLI	$I30 index attributes $Secure:$SDS security descriptors Master File Table ($MFT) Mounted Disk Images (ISO, IMG, VHD, VHDX) Syscache.hve USN Journal ($UsnJrnl:$J) Zone.Identifier (Mark of the Web)
AmcacheParserEric Zimmerman	CLI	Amcache.hve Installed Programs (Uninstall Keys, MSI, AppX) Kernel Drivers (.sys, Driver Services, BYOVD) OpenSSH Server and Client Windows Subsystem for Linux (WSL)
AutorunsSysinternals	GUI	IFEO and Winlogon persistence Kernel Drivers (.sys, Driver Services, BYOVD) Run keys and Startup folders Windows Services WMI repository and SCCM RecentlyUsedApps
dfir_ntfs	Library · open source	$I30 index attributes $LogFile (NTFS transaction log) Master File Table ($MFT) USN Journal ($UsnJrnl:$J) Volume Shadow Copies (VSS)
Get-WinEventMicrosoft	CLI · built into Windows	Event Trace Logs (ETL files) OpenSSH Server and Client Sysmon Event Log Windows Firewall Logs
Hayabusa	CLI · open source	PowerShell logs and history RDP connection artifacts Sysmon Event Log Windows event logs (EVTX)
KAPEEric Zimmerman	CLI	Notepad TabState (Windows 11) Remote access tools (RMM) Volume Shadow Copies (VSS) Windows Recall (Copilot+ PC snapshots)
PECmdEric Zimmerman	CLI	Mounted Disk Images (ISO, IMG, VHD, VHDX) OpenSSH Server and Client Prefetch Files (.pf) Windows Subsystem for Linux (WSL)
SQLECmdEric Zimmerman	CLI	Browser artifacts (Chrome, Edge, Firefox) Notification database (wpndatabase.db) Sticky Notes (plum.sqlite and StickyNotes.snt) Windows Timeline (ActivitiesCache.db)
Volatility 3	CLI · open source	Clipboard history Crash dumps (MEMORY.DMP, minidumps) hiberfil.sys (hibernation file) Kernel Drivers (.sys, Driver Services, BYOVD)
bulk_extractor	CLI · open source	hiberfil.sys (hibernation file) pagefile.sys and swapfile.sys Print spooler files (.SPL and .SHD)
Chainsaw	CLI · open source	PowerShell logs and history Sysmon Event Log Windows event logs (EVTX)
impacket	CLI · open source	DPAPI and Credential Manager NTDS.dit and domain controllers SAM hive and user accounts
Arsenal Image Mounter	GUI	Volume Shadow Copies (VSS) Windows Subsystem for Linux (WSL)
ccl_chromium_reader	Library · open source	Desktop messaging apps (Slack, Signal, WhatsApp…) Microsoft Teams (classic and new client)
ChromeCacheViewNirSoft	GUI	Desktop messaging apps (Slack, Signal, WhatsApp…) Microsoft Teams (classic and new client)
JLECmdEric Zimmerman	CLI	Jump Lists Mounted Disk Images (ISO, IMG, VHD, VHDX)
LECmdEric Zimmerman	CLI	LNK shortcut files Mounted Disk Images (ISO, IMG, VHD, VHDX)
libesedblibyal	Library · open source	NTDS.dit and domain controllers Windows Search index
Log Parser	CLI	IIS Web Server Logs Windows Firewall Logs
NTFS Log Tracker	GUI	$LogFile (NTFS transaction log) USN Journal ($UsnJrnl:$J)
sigcheckSysinternals	CLI	Kernel Drivers (.sys, Driver Services, BYOVD) PE files (Windows executables)
The Sleuth Kit	CLI · open source	Master File Table ($MFT) Windows Subsystem for Linux (WSL)
Thumbcache Viewer	GUI · open source	Thumbcache Windows Search index
Timeline ExplorerEric Zimmerman	GUI	IIS Web Server Logs Program Compatibility Assistant (PCA)
WinDbg	GUI	Crash dumps (MEMORY.DMP, minidumps) Windows Error Reporting (WER)
WxTCmdEric Zimmerman	CLI	Clipboard history Windows Timeline (ActivitiesCache.db)
YARA	CLI · open source	pagefile.sys and swapfile.sys PE files (Windows executables)
010 Editor	GUI · commercial	Notepad TabState (Windows 11)
Aid4Mail	GUI · commercial	Outlook data files (PST and OST)
AppCompatCacheParserEric Zimmerman	CLI	ShimCache (AppCompatCache)
AppCrashViewNirSoft	GUI	Windows Error Reporting (WER)
AppResourcesUsageViewNirSoft	GUI	SRUM (System Resource Usage Monitor)
BitsParser	CLI · open source	BITS jobs (qmgr database)
BlueScreenViewNirSoft	GUI	Crash dumps (MEMORY.DMP, minidumps)
BluetoothViewNirSoft	GUI	Bluetooth paired devices
bmc-tools	CLI · open source	RDP bitmap cache
BrowsingHistoryViewNirSoft	GUI	Browser artifacts (Chrome, Edge, Firefox)
capa	CLI · open source	PE files (Windows executables)
CCM_RUA_Finder	CLI · open source	WMI repository and SCCM RecentlyUsedApps
Community TabState parsers	—	Notepad TabState (Windows 11)
DataProtectionDecryptorNirSoft	GUI	DPAPI and Credential Manager
DB Browser for SQLCipher	GUI · open source	Desktop messaging apps (Slack, Signal, WhatsApp…)
Detect It Easy	GUI · open source	PE files (Windows executables)
dfindexeddb	Library · open source	Microsoft Teams (classic and new client)
DHParser	—	Microsoft Defender logs and quarantine
Dissect	Library · open source	Microsoft Defender logs and quarantine
driverqueryMicrosoft	CLI · built into Windows	Kernel Drivers (.sys, Driver Services, BYOVD)
DSInternals	Library · open source	NTDS.dit and domain controllers
EMF Spool Viewer	—	Print spooler files (.SPL and .SHD)
ESEDatabaseViewNirSoft	GUI	Windows Search index
etl-parser	CLI · open source	Event Trace Logs (ETL files)
Event ViewerMicrosoft	GUI · built into Windows	Windows event logs (EVTX)
ExecutedProgramsListNirSoft	GUI	MUICache
Forensic Email Collector	GUI · commercial	Outlook data files (PST and OST)
forensicsim	CLI · open source	Microsoft Teams (classic and new client)
Get-AppxPackageMicrosoft	CLI · built into Windows	Installed Programs (Uninstall Keys, MSI, AppX)
gpresultMicrosoft	CLI · built into Windows	Group Policy artifacts
GroupPolicy PowerShell moduleMicrosoft	Library · built into Windows	Group Policy artifacts
Hibernation Recon	GUI · commercial	hiberfil.sys (hibernation file)
Hibr2Bin	CLI · open source	hiberfil.sys (hibernation file)
Hindsight	CLI · open source	Browser artifacts (Chrome, Edge, Firefox)
Indx2Csv	CLI · open source	$I30 index attributes
INDXParse	CLI · open source	$I30 index attributes
LevelDBDumper	—	Microsoft Teams (classic and new client)
liblnklibyal	Library · open source	LNK shortcut files
libolecflibyal	Library · open source	Jump Lists
libsccalibyal	Library · open source	Prefetch Files (.pf)
libvshadowlibyal	Library · open source	Volume Shadow Copies (VSS)
libwtcdblibyal	Library · open source	Thumbcache
Log Parser Studio	GUI	IIS Web Server Logs
LogFileParser	CLI · open source	$LogFile (NTFS transaction log)
Magnet AXIOM	Platform · commercial	Outlook data files (PST and OST)
MemProcFS	CLI · open source	Crash dumps (MEMORY.DMP, minidumps)
mimikatz	CLI · open source	DPAPI and Credential Manager
MiTeC Structured Storage Viewer	GUI	Sticky Notes (plum.sqlite and StickyNotes.snt)
mplog_parser	CLI · open source	Microsoft Defender logs and quarantine
ntdsutilMicrosoft	CLI · built into Windows	NTDS.dit and domain controllers
odl.py	—	OneDrive sync client
OneDriveExplorer	GUI · open source	OneDrive sync client
pefile	Library · open source	PE files (Windows executables)
PerfView	GUI · open source	Event Trace Logs (ETL files)
PEStudio	GUI	PE files (Windows executables)
pffexportlibyal	CLI · open source	Outlook data files (PST and OST)
PhotoRec	CLI · open source	pagefile.sys and swapfile.sys
PowerShellMicrosoft	CLI · built into Windows	Zone.Identifier (Mark of the Web)
python-cim	Library · open source	WMI repository and SCCM RecentlyUsedApps
python-evtx	Library · open source	Windows event logs (EVTX)
PyWMIPersistenceFinder	CLI · open source	WMI repository and SCCM RecentlyUsedApps
RBCmdEric Zimmerman	CLI	Recycle Bin
RdpCacheStitcher	GUI · open source	RDP bitmap cache
readpst	CLI · open source	Outlook data files (PST and OST)
RecentFileCacheParserEric Zimmerman	CLI	RecentFileCache.bcf
regipy	Library · open source	Registry hives
rfc.pl	—	RecentFileCache.bcf
Rifiuti2	CLI · open source	Recycle Bin
SBECmdEric Zimmerman	CLI	ShellBags
SharpDPAPI	CLI · open source	DPAPI and Credential Manager
ShellBags ExplorerEric Zimmerman	GUI	ShellBags
ShimCacheParser	CLI · open source	ShimCache (AppCompatCache)
SIDR	CLI · open source	Windows Search index
sigtop	CLI · open source	Desktop messaging apps (Slack, Signal, WhatsApp…)
SPLViewer	GUI · open source	Print spooler files (.SPL and .SHD)
srum-dump	CLI · open source	SRUM (System Resource Usage Monitor)
SrumECmdEric Zimmerman	CLI	SRUM (System Resource Usage Monitor)
StickyParser	CLI · open source	Sticky Notes (plum.sqlite and StickyNotes.snt)
StreamsSysinternals	CLI	Zone.Identifier (Mark of the Web)
stringsSysinternals	CLI	pagefile.sys and swapfile.sys
TaskSchedulerViewNirSoft	GUI	Scheduled Tasks
tg-desktop-investigation	—	Desktop messaging apps (Slack, Signal, WhatsApp…)
Thumbs Viewer	GUI · open source	Thumbcache
TotalRecall	CLI · open source	Windows Recall (Copilot+ PC snapshots)
tracerptMicrosoft	CLI · built into Windows	Event Trace Logs (ETL files)
USBDeviewNirSoft	GUI	USB device history
UserAssistViewNirSoft	GUI	UserAssist
VSCMountEric Zimmerman	CLI	Volume Shadow Copies (VSS)
WifiHistoryViewNirSoft	GUI	Network profiles (NetworkList)
Windows Performance Analyzer	GUI	Event Trace Logs (ETL files)
WinPrefetchViewNirSoft	GUI	Prefetch Files (.pf)
XstReader	GUI · open source	Outlook data files (PST and OST)
yarp	Library · open source	Registry hives