Tags: registry

Triage-IR is a script written by Michael Ahrendt, which will collect system information, network information, registry hives, disk information and will also dump memory. One of the capabilities of Triage-IR is collecting information from Volume Shadow Cop ...

Software to gather the Volume Serial Number from an attached device including CDs. V5 now includes a built in registry viewer (NTUSER, SAM, SYSTEM, SOFTWARE) and disk explorer with multiple viewing formats.

USBDeviceForensics is an application to extract numerous bits of information regarding USB devices. it uses the infomration from a SANS blog posting to retrieve operating system specific information. It now has the ability to process multiple NTUSER.dat r ...