Artifact Analysis  Registry/Event Analysis  NTFS Analysis  Network Utilities  PE Utilities  Miscellaneous



Artifact Analysis  (top)

   Windows Prefetch Parser (pf)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:pf32.v.1.39.win.zippf64.v.1.39.win.zippf64a.v.1.39.win.zipmd5/sha1
Linux:pf32.v.1.39.lin.tar.gz*pf64.v.1.39.lin.tar.gzpf64a.v.1.39.lin.tar.gzmd5/sha1
macOS:Not Availablepf.v.1.39.dmgpf.v.1.39.dmgmd5/sha1
   Windows 'index.dat' Parser (id)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:id32.v.0.92.win.zipid64.v.0.92.win.zipid64a.v.0.92.win.zipmd5/sha1
Linux:id32.v.0.92.lin.tar.gz*id64.v.0.92.lin.tar.gzid64a.v.0.92.lin.tar.gzmd5/sha1
macOS:Not Availableid.v.0.92.dmgid.v.0.92.dmgmd5/sha1
   Windows LNK Parsing Utility (lp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:lp32.v.1.07.win.ziplp64.v.1.07.win.ziplp64a.v.1.07.win.zipmd5/sha1
Linux:lp32.v.1.07.lin.tar.gz*lp64.v.1.07.lin.tar.gzlp64a.v.1.07.lin.tar.gzmd5/sha1
macOS:Not Availablelp.v.1.07.dmglp.v.1.07.dmgmd5/sha1
   Windows USB Storage Parser (usp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:usp32.v.0.79.win.zipusp64.v.0.79.win.zipusp64a.v.0.79.win.zipmd5/sha1
Linux:usp32.v.0.79.lin.tar.gz*usp64.v.0.79.lin.tar.gzusp64a.v.0.79.lin.tar.gzmd5/sha1
macOS:Not Availableusp.v.0.79.dmgusp.v.0.79.dmgmd5/sha1
   Timeline ActivitiesCache Parser (tac)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:tac32.v.0.34.win.ziptac64.v.0.34.win.ziptac64a.v.0.34.win.zipmd5/sha1
Linux:tac32.v.0.34.lin.tar.gz*tac64.v.0.34.lin.tar.gztac64a.v.0.34.lin.tar.gzmd5/sha1
macOS:Not Availabletac.v.0.34.dmgtac.v.0.34.dmgmd5/sha1
   Windows Jump List Parser (jmp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:jmp32.v.0.63.win.zipjmp64.v.0.63.win.zipjmp64a.v.0.63.win.zipmd5/sha1
Linux:jmp32.v.0.63.lin.tar.gz*jmp64.v.0.63.lin.tar.gzjmp64a.v.0.63.lin.tar.gzmd5/sha1
macOS:Not Availablejmp.v.0.63.dmgjmp.v.0.63.dmgmd5/sha1
   Windows Shim Database (SDB) Parser (shims)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:shims32.v.0.44.win.zipshims64.v.0.44.win.zipshims64a.v.0.44.win.zipmd5/sha1
Linux:shims32.v.0.44.lin.tar.gz*shims64.v.0.44.lin.tar.gzshims64a.v.0.44.lin.tar.gzmd5/sha1
macOS:Not Availableshims.v.0.44.dmgshims.v.0.44.dmgmd5/sha1
   Trash Inspection & Analysis (tia)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:tia32.v.0.36.win.ziptia64.v.0.36.win.ziptia64a.v.0.36.win.zipmd5/sha1
Linux:tia32.v.0.36.lin.tar.gz*tia64.v.0.36.lin.tar.gztia64a.v.0.36.lin.tar.gzmd5/sha1
macOS:Not Availabletia.v.0.36.dmgtia.v.0.36.dmgmd5/sha1
   Safari Artifact Parser (sap)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:sap32.v.0.17.win.zipsap64.v.0.17.win.zipsap64a.v.0.17.win.zipmd5/sha1
Linux:sap32.v.0.17.lin.tar.gz*sap64.v.0.17.lin.tar.gzsap64a.v.0.17.lin.tar.gzmd5/sha1
macOS:Not Availablesap.v.0.17.dmgsap.v.0.17.dmgmd5/sha1
   Windows Push Notification DB Parser (wpn)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:wpn32.v.0.30.win.zipwpn64.v.0.30.win.zipwpn64a.v.0.30.win.zipmd5/sha1
Linux:wpn32.v.0.30.lin.tar.gz*wpn64.v.0.30.lin.tar.gzwpn64a.v.0.30.lin.tar.gzmd5/sha1
macOS:Not Availablewpn.v.0.30.dmgwpn.v.0.30.dmgmd5/sha1
   MS Office Backstage Parser (bs)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:bs32.v.0.22.win.zipbs64.v.0.22.win.zipbs64a.v.0.22.win.zipmd5/sha1
Linux:bs32.v.0.22.lin.tar.gz*bs64.v.0.22.lin.tar.gzbs64a.v.0.22.lin.tar.gzmd5/sha1
macOS:Not Availablebs.v.0.22.dmgbs.v.0.22.dmgmd5/sha1
   Chromium SQLite Parser (csp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:csp32.v.0.25.win.zipcsp64.v.0.25.win.zipcsp64a.v.0.25.win.zipmd5/sha1
Linux:csp32.v.0.25.lin.tar.gz*csp64.v.0.25.lin.tar.gzcsp64a.v.0.25.lin.tar.gzmd5/sha1
macOS:Not Availablecsp.v.0.25.dmgcsp.v.0.25.dmgmd5/sha1
   Mozilla SQLite Parser (msp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:msp32.v.0.19.win.zipmsp64.v.0.19.win.zipmsp64a.v.0.19.win.zipmd5/sha1
Linux:msp32.v.0.19.lin.tar.gz*msp64.v.0.19.lin.tar.gzmsp64a.v.0.19.lin.tar.gzmd5/sha1
macOS:Not Availablemsp.v.0.19.dmgmsp.v.0.19.dmgmd5/sha1
   Mozilla Cache Parser (mcp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:mcp32.v.0.21.win.zipmcp64.v.0.21.win.zipmcp64a.v.0.21.win.zipmd5/sha1
Linux:mcp32.v.0.21.lin.tar.gz*mcp64.v.0.21.lin.tar.gzmcp64a.v.0.21.lin.tar.gzmd5/sha1
macOS:Not Availablemcp.v.0.21.dmgmcp.v.0.21.dmgmd5/sha1
   Chromium Cache Parser (ccp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:ccp32.v.0.14.win.zipccp64.v.0.14.win.zipccp64a.v.0.14.win.zipmd5/sha1
Linux:ccp32.v.0.14.lin.tar.gz*ccp64.v.0.14.lin.tar.gzccp64a.v.0.14.lin.tar.gzmd5/sha1
macOS:Not Availableccp.v.0.14.dmgccp.v.0.14.dmgmd5/sha1
   FAT32 & exFAT Analysis (fata)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:fata32.v.0.13.win.zipfata64.v.0.13.win.zipfata64a.v.0.13.win.zipmd5/sha1
Linux:fata32.v.0.13.lin.tar.gz*fata64.v.0.13.lin.tar.gzfata64a.v.0.13.lin.tar.gzmd5/sha1
macOS:Not Availablefata.v.0.13.dmgfata.v.0.3.dmgmd5/sha1


Registry and Event Log Analysis  (top)

   Yet Another Registry Utility (yaru)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:yaru32.v.1.90.win.zipyaru64.v.1.90.win.zipyaru64a.v.1.90.win.zipmd5/sha1
Linux:yaru32.v.1.90.lin.tar.gz*yaru64.v.1.90.lin.tar.gzyaru64a.v.1.90.lin.tar.gzmd5/sha1
macOS:Not Availableyaru.v.1.90.dmgyaru.v.1.90.dmgmd5/sha1
   Windows Event Log Viewer (evtx_view)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:evtx_view32.v.1.21.win.zipevtx_view64.v.1.21.win.zipevtx_view64a.v.1.21.win.zipmd5/sha1
Linux:evtx_view32.v.1.21.lin.tar.gz*evtx_view64.v.1.21.lin.tar.gzevtx_view64a.v.1.21.lin.tar.gzmd5/sha1
macOS:Not Availableevtx_view.v.1.21.dmgevtx_view.v.1.21.dmgmd5/sha1
   Windows ShellBag Parser (sbag)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:sbag32.v.0.79.win.zipsbag64.v.0.79.win.zipsbag64a.v.0.79.win.zipmd5/sha1
Linux:sbag32.v.0.79.lin.tar.gz*sbag64.v.0.79.lin.tar.gzsbag64a.v.0.79.lin.tar.gzmd5/sha1
macOS:Not Availablesbag.v.0.79.dmgsbag.v.0.79.dmgmd5/sha1
   Computer Account Forensic Artifact Extractor (cafae)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:cafae32.v.0.79.win.zipcafae64.v.0.79.win.zipcafae64a.v.0.79.win.zipmd5/sha1
Linux:cafae32.v.0.79.lin.tar.gz*cafae64.v.0.79.lin.tar.gzcafae64a.v.0.79.lin.tar.gzmd5/sha1
macOS:Not Availablecafae.v.0.79.dmgcafae.v.0.79.dmgmd5/sha1
   Windows Event Log Parser (evtwalk)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:evtwalk32.v.0.64.win.zipevtwalk64.v.0.64.win.zipevtwalk64a.v.0.64.win.zipmd5/sha1
Linux:evtwalk32.v.0.64.lin.tar.gz*evtwalk64.v.0.64.lin.tar.gzevtwalk64a.v.0.64.lin.tar.gzmd5/sha1
macOS:Not Availableevtwalk.v.0.64.dmgevtwalk.v.0.64.dmgmd5/sha1
   Windows AppCompatibility Cache Utility (wacu)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:wacu32.v.0.52.win.zipwacu64.v.0.52.win.zipwacu64a.v.0.52.win.zipmd5/sha1
Linux:wacu32.v.0.52.lin.tar.gz*wacu64.v.0.52.lin.tar.gzwacu64a.v.0.52.lin.tar.gzmd5/sha1
macOS:Not Availablewacu.v.0.52.dmgwacu.v.0.52.dmgmd5/sha1
   Event Log MessageTables Offline (elmo)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:elmo32.v.0.44.win.zipelmo64.v.0.44.win.zipelmo64a.v.0.44.win.zipmd5/sha1
Linux:elmo32.v.0.44.lin.tar.gz*elmo64.v.0.44.lin.tar.gzelmo64a.v.0.44.lin.tar.gzmd5/sha1
macOS:Not Availableelmo.v.0.44.dmgelmo.v.0.44.dmgmd5/sha1
   Trace Event Log and Analysis (tela)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:tela32.v.0.30.win.ziptela64.v.0.30.win.ziptela64a.v.0.30.win.zipmd5/sha1
Linux:tela32.v.0.30.lin.tar.gz*tela64.v.0.30.lin.tar.gztela64a.v.0.30.lin.tar.gzmd5/sha1
macOS:Not Availabletela.v.0.30.dmgtela.v.0.30.dmgmd5/sha1
   Windows EVTX Fragment eXtension Parser (evtfx)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:evtfx32.v.0.15.win.zipevtfx64.v.0.15.win.zipevtfx64a.v.0.15.win.zipmd5/sha1
Linux:evtfx32.v.0.15.lin.tar.gz*evtfx64.v.0.15.lin.tar.gzevtfx64a.v.0.15.lin.tar.gzmd5/sha1
macOS:Not Availableevtfx.v.0.15.dmgevtfx.v.0.15.dmgmd5/sha1


NTFS Filesystem Analysis  (top)

   Windows Journal Parser (jp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:jp32.v.1.49.win.zipjp64.v.1.49.win.zipjp64a.v.1.49.win.zipmd5/sha1
Linux:jp32.v.1.49.lin.tar.gz*jp64.v.1.49.lin.tar.gzjp64a.v.1.49.lin.tar.gzmd5/sha1
macOS:Not Availablejp.v.1.49.dmgjp.v.1.49.dmgmd5/sha1
   NTFS Directory Enumerator (ntfsdir)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:ntfsdir32.v.1.45.win.zipntfsdir64.v.1.45.win.zipntfsdir64a.v.1.45.win.zipmd5/sha1
Linux:ntfsdir32.v.1.45.lin.tar.gz*ntfsdir64.v.1.45.lin.tar.gzntfsdir64a.v.1.45.lin.tar.gzmd5/sha1
macOS:Not Availablentfsdir.v.1.45.dmgntfsdir.v.1.45.dmgmd5/sha1
   NTFS File Copy Utility (ntfscopy)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:ntfscopy32.v.1.13.win.zipntfscopy64.v.1.13.win.zipntfscopy64a.v.1.13.win.zipmd5/sha1
Linux:ntfscopy32.v.1.13.lin.tar.gz*ntfscopy64.v.1.13.lin.tar.gzntfscopy64a.v.1.13.lin.tar.gzmd5/sha1
macOS:Not Availablentfscopy.v.1.13.dmgntfscopy.v.1.13.dmgmd5/sha1
   Windows $MFT and NTFS Metadata Extractor Tool (ntfswalk)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:ntfswalk32.v.0.95.win.zipntfswalk64.v.0.95.win.zipntfswalk64a.v.0.95.win.zipmd5/sha1
Linux:ntfswalk32.v.0.95.lin.tar.gz*ntfswalk64.v.0.95.lin.tar.gzntfswalk64a.v.0.95.lin.tar.gzmd5/sha1
macOS:Not Availablentfswalk.v.0.95.dmgntfswalk.v.0.95.dmgmd5/sha1
   Windows INDX Slack Parser (wisp)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:wisp32.v.0.58.win.zipwisp64.v.0.58.win.zipwisp64a.v.0.58.win.zipmd5/sha1
Linux:wisp32.v.0.58.lin.tar.gz*wisp64.v.0.58.lin.tar.gzwisp64a.v.0.58.lin.tar.gzmd5/sha1
macOS:Not Availablewisp.v.0.58.dmgwisp.v.0.58.dmgmd5/sha1
   Graphical Engine for NTFS Analysis (gena)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:gena32.v.0.60.win.zipgena64.v.0.60.win.zipgena64a.v.0.60.win.zipmd5/sha1
Linux:gena32.v.0.60.lin.tar.gz*gena64.v.0.60.lin.tar.gzgena64a.v.0.60.lin.tar.gzmd5/sha1
macOS:Not Availablegena.v.0.60.dmggena.v.0.59.dmgmd5/sha1
   $MFT and $LogFile Analysis (mala)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:mala32.v.0.23.win.zipmala64.v.0.23.win.zipmala64a.v.0.23.win.zipmd5/sha1
Linux:mala32.v.0.23.lin.tar.gz*mala64.v.0.23.lin.tar.gzmala64a.v.0.23.lin.tar.gzmd5/sha1
macOS:Not Availablemala.v.0.23.dmgmala.v.0.23.dmgmd5/sha1


Network Support Utilities  (top)

   DNS Query Utility (dqu)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:dqu32.v.0.48.win.zipdqu64.v.0.48.win.zipdqu64a.v.0.48.win.zipmd5/sha1
Linux:dqu32.v.0.48.lin.tar.gz*dqu64.v.0.48.lin.tar.gzdqu64a.v.0.48.lin.tar.gzmd5/sha1
macOS:Not Availabledqu.v.0.48.dmgdqu.v.0.48.dmgmd5/sha1
   Packet Capture ICMP Carver (pic)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:pic32.v.0.39.win.zippic64.v.0.39.win.zippic64a.v.0.39.win.zipmd5/sha1
Linux:pic32.v.0.39.lin.tar.gz*pic64.v.0.39.lin.tar.gzpic64a.v.0.39.lin.tar.gzmd5/sha1
macOS:Not AvailableNot AvailableNot Available
   Network Xfer Client/Server Utility (nx)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:nx32.v.0.42.win.zipnx64.v.0.42.win.zipnx64a.v.0.42.win.zipmd5/sha1
Linux:nx32.v.0.42.lin.tar.gz*nx64.v.0.42.lin.tar.gznx64a.v.0.42.lin.tar.gzmd5/sha1
macOS:Not Availablenx.v.0.42.dmgnx.v.0.42.dmgmd5/sha1
   Modular Inspection Network Xfer Agent (minx)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:minx32.v.0.28.win.zipminx64.v.0.28.win.zipminx64a.v.0.28.win.zipmd5/sha1
Linux:minx32.v.0.28.lin.tar.gz*minx64.v.0.28.lin.tar.gzminx64a.v.0.28.lin.tar.gzmd5/sha1
macOS:Not Availableminx.v.0.28.dmgminx.v.0.28.dmgmd5/sha1


Portable Executable Utilities  (top)

   Windows Portable Executable Viewer (pe_view)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:pe_view32.v.1.26.win.zippe_view64.v.1.26.win.zippe_view64a.v.1.26.win.zipmd5/sha1
Linux:pe_view32.v.1.26.lin.tar.gz*pe_view64.v.1.26.lin.tar.gzpe_view64a.v.1.26.lin.tar.gzmd5/sha1
macOS:Not Availablepe_view.v.1.26.dmgpe_view.v.1.26.dmgmd5/sha1
   Portable Executable Scanner (pescan)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:pescan32.v.0.65.win.zippescan64.v.0.65.win.zippescan64a.v.0.65.win.zipmd5/sha1
Linux:pescan32.v.0.65.lin.tar.gz*pescan64.v.0.65.lin.tar.gzpescan64a.v.0.65.lin.tar.gzmd5/sha1
macOS:Not Availablepescan.v.0.65.dmgpescan.v.0.65.dmgmd5/sha1


Miscellaneous Tools  (top)

   Volume Shadow Snapshot Enumerator (vssenum)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:vssenum32.v.0.37.win.zipvssenum64.v.0.37.win.zipvssenum64a.v.0.37.win.zipmd5/sha1
Linux:Not AvailableNot AvailableNot Available
macOS:Not AvailableNot AvailableNot Available
   Windows Symbol Fetch Utility (sf)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:sf32.v.0.64.win.zipsf64.v.0.64.win.zipsf64a.v.0.64.win.zipmd5/sha1
Linux:Not AvailableNot AvailableNot Available
macOS:Not AvailableNot AvailableNot Available
   CSV Data eXchange (csvdx)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:csvdx32.v.0.41.win.zipcsvdx64.v.0.41.win.zipcsvdx64a.v.0.41.win.zipmd5/sha1
Linux:csvdx32.v.0.41.lin.tar.gz*csvdx64.v.0.41.lin.tar.gzcsvdx64a.v.0.41.lin.tar.gzmd5/sha1
macOS:Not Availablecsvdx.v.0.41.dmgcsvdx.v.0.41.dmgmd5/sha1
   Disk Utility & Packer (dup)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:dup32.v.0.48.win.zipdup64.v.0.48.win.zipdup64a.v.0.48.win.zipmd5/sha1
Linux:Not Availabledup64.v.0.48.lin.tar.gzdup64a.v.0.48.lin.tar.gzmd5/sha1
macOS:Not Availabledup.v.0.48.dmgdup.v.0.48.dmgmd5/sha1


Package Builds  (top)

   May 2024 build (package)
Intel 32-bit Version Intel 64-bit Version ARM 64-bit Version
Windows:2024.05.05.win32.zip2024.05.05.win64.zip2024.05.05.win64a.zipmd5/sha1
Linux:Not Available2024.05.05.lin64.zip2024.05.05.lin64a.zipmd5/sha1
macOS:Not Available2024.05.05.mac.dmg2024.05.05.mac.dmgmd5/sha1
*32bit apps can run in a 64bit linux distribution if "ia32-libs" (and dependencies) are present.