Skip to content

kacos2000/Win10

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Windows 10/11 stuff

File Description
Automatic/Custom Destinations, BagMRU & ShellLNK (LNK) Browser
$MFT directory tree reconstruction & FILE record browser
Background Activity Moderator (Win10 v1803/1809/1903) Bam preview
Background Activity Service and registry entries. Powershell parsers & info.
PowerShell History (pdf) PowerShell script to read the current user's log(s).
SQLite queries Various sqlite queries (Browser data, Skype etc)
Cortana Cortana preview
Some notes on Cortana (pdf)
Desktop Icon Layouts Desktop preview
List of user desktop icon/shortcuts/files (registry) (pdf)
MS Edge Container permissions MS Edge Access permissions (test notes)
MS Edge Containers MS Edge container info (test notes) (pdf)
USB devices USB device history in the registry (test notes) (pdf)
Unix Hex to Time conversion Excel spreadsheet to convert UNIX dates in Hexadecimal to readable DateTime
Windows Installation and Upgrades Upgrades preview
How to determine the original Windows Installation date. (pdf)
Zone.Identifier ADS view Powershell preview
PowerShell script to list Alternate Data Streams and view the Zone.Identifier ADS contents of files in the selected folder/subfolders. More info at Phill Moore's blog and at [Hacking Exposed](http://www.hecfblog.com/2018/06/daily-blog-402-solution-saturday-62318.html. Also, powerShell script to list Files/Folders that are HardLinks or Junction Points.
Windows 10 Timeline (Win10 v1803/1809/1903) Analysis of Windows 10 timeline feature.
SQLite queries, Powershell scripts & info.
Windows 10 Notifications SQLite query of the (Push) Notifications dB, Powershell scripts & other info
Windows 10 Sticky Notes SQLite query and info
Windows 10 (v1809/1903): YourPhone app SQLite query to view the Contacts & SMS Messages plus info.
Windows 10 event log parsers PowerShell scripts to read live or offline Windows event log(s), Eventlog keyword lists, OpCodes etc.
Windows 10 AmCache.hve parser PowerShell scripts to parse the AmCache hive.
Windows 10 Search JumpList PowerShell script to parse the Windows 10 'Search JumpList' entries
NTFS ObjectIDs powershell script listing the NTFS $MFT ObjectID's of files in selected Folder & subfolders. Powershell script to parse a local or mounted drive and save the $USN journal to a comma separated file. Also, a script to get NTFS information from a local or mounted drive and get user readable results. All three use Windows's "fsutil.exe" command.
Windows Diagnostics Infrastructure Powershell script that uses Microsoft TraceRpt.Exe to convert all Event Trace Logs (.ETL) of the target "\Windows\System32\WDI" folder to the respective summary.txt and eventlog.csv (comma separated file). It also copies the StartupInfo folder and it's contents.
Office Document Cache OfficeFileCachePowerShell scripts & EXEs to parse MS Office ..stuff :)
Windows Media Player Library Metadata parser wmpl Windows Media Player Library Metadata parser
Win 11 Program-Compatibility parser image