Joakim Schicht

RunAsTI. Launch processes with TrustedInstaller privilege

RawCopy. Commandline low level file extractor for NTFS

Mft2Csv. Extract $MFT record info and log it to a csv file.

LogFileParser. Parser for $LogFile on NTFS

UsnJrnl2Csv. Parser for $UsnJrnl on NTFS

ExtractUsnJrnl. Tool to extract the $UsnJrnl from an NTFS volume

SetMace. Manipulate timestamps on NTFS

EaTools. Analysis and manipulation of extended attribute ($EA) on NTFS

Indx2Csv. An advanced parser for INDX records

PowerMft. Powerful commandline $MFT record editor.

SectorIo. Kernel mode driver for writing to physical disk with SL_FORCE_DIRECT_WRITE

Secure2Csv. Decode security descriptors in $Secure on NTFS

NtfsFileExtractor. Extract files off NTFS

HideAndProtect. Makes files super hidden on NTFS

SetRegTime. Registry timestamp manipulation

MftCarver. Carve $MFT records from a chunk of data (for instance a memory dump)

NtSuspendProcess. Suspend and resume processes by using functions in ntdll.dll.

StegoMft. PoC for hiding data within $MFT

MftRcrd. Command line $MFT record decoder

IndxCarver. Carve INDX records from a chunk of data.

UsnJrnlCarver. Carving Usn pages (UsnJrnl records)

NativeRegMod. A native application that can modify registry

RemoveCertificate. Removes the authenticode digital signature (certificate) from an executable

MyDiskEraser. How to make your own disk erasing boot cd.

RcrdCarver. Carve RCRD records ($LogFile) from a chunk of data.

ExtractAllAttributes. Extracts all attributes of files on NTFS

ProcessCritical. Manipulate ProcessBreakOnTermination in ProcessInfoClass on any process from command line

RegKeyFixer. Dealing with certain invalid registry keys

RawDir. A low level dir command for NTFS volumes

HexDump. Dump binary data to console from file or disk

MakeContainer. Tools to create special containers for patched VeraCrypt/TrueCrypt

ExtractFromDataRun. Extract files from NTFS by run list

MakeImage. Create graphic bitmap from binary data.

PartDump. Utility to dump basic volume information from a disk object.

Tiny_NTFS. Smallest possible size of a NTFS partition

SystemTimeAdjustment. Manipulates the speed of the system clock

GetProcAddressGUI. Retrieve shellcode formatted address of function from module

VeraCrypt. Tweaked version for supporting arbitrary offsets.

Binary2Bmp. Turn any file into a bmp

Volsnap-Bug-Content. Content for a volsnap.sys bug analysis

MftRef2Name. Resolve file index number to name or vice versa on NTFS