| File | Description |
|---|---|
| Automatic/Custom Destinations, BagMRU & ShellLNK (LNK) Browser |  |
| $MFT directory tree reconstruction & FILE record browser |  |
| Background Activity Moderator (Win10 v1803/1809/1903) |  Background Activity Service and registry entries. Powershell parsers & info. |
| PowerShell History (pdf) | PowerShell script to read the current user's log(s). |
| SQLite queries | Various sqlite queries (Browser data, Skype etc) |
| Cortana |  Some notes on Cortana (pdf) |
| Desktop Icon Layouts |  List of user desktop icon/shortcuts/files (registry) (pdf) |
| MS Edge Container permissions | MS Edge Access permissions (test notes) |
| MS Edge Containers | MS Edge container info (test notes) (pdf) |
| USB devices | USB device history in the registry (test notes) (pdf) |
| Unix Hex to Time conversion | Excel spreadsheet to convert UNIX dates in Hexadecimal to readable DateTime |
| Windows Installation and Upgrades |  How to determine the original Windows Installation date. (pdf) |
| Zone.Identifier ADS view |  PowerShell script to list Alternate Data Streams and view the Zone.Identifier ADS contents of files in the selected folder/subfolders. More info at Phill Moore's blog and at [Hacking Exposed](http://www.hecfblog.com/2018/06/daily-blog-402-solution-saturday-62318.html. Also, powerShell script to list Files/Folders that are HardLinks or Junction Points. |
| Windows 10 Timeline (Win10 v1803/1809/1903) | Analysis of Windows 10 timeline feature. SQLite queries, Powershell scripts & info. |
| Windows 10 Notifications | SQLite query of the (Push) Notifications dB, Powershell scripts & other info |
| Windows 10 Sticky Notes | SQLite query and info |
| Windows 10 (v1809/1903): YourPhone app | SQLite query to view the Contacts & SMS Messages plus info. |
| Windows 10 event log parsers | PowerShell scripts to read live or offline Windows event log(s), Eventlog keyword lists, OpCodes etc. |
| Windows 10 AmCache.hve parser | PowerShell scripts to parse the AmCache hive. |
| Windows 10 Search JumpList | PowerShell script to parse the Windows 10 'Search JumpList' entries |
| NTFS ObjectIDs | powershell script listing the NTFS $MFT ObjectID's of files in selected Folder & subfolders. Powershell script to parse a local or mounted drive and save the $USN journal to a comma separated file. Also, a script to get NTFS information from a local or mounted drive and get user readable results. All three use Windows's "fsutil.exe" command. |
| Windows Diagnostics Infrastructure | Powershell script that uses Microsoft TraceRpt.Exe to convert all Event Trace Logs (.ETL) of the target "\Windows\System32\WDI" folder to the respective summary.txt and eventlog.csv (comma separated file). It also copies the StartupInfo folder and it's contents. |
| Office Document Cache |  PowerShell scripts & EXEs to parse MS Office ..stuff :) |
| Windows Media Player Library Metadata parser |  Windows Media Player Library Metadata parser |
| Win 11 Program-Compatibility parser |  |