jschicht

Joakim Schicht's repositories

RunAsTI

Launch processes with TrustedInstaller privilege

Language:AutoItMIT374 25 9

RawCopy

Commandline low level file extractor for NTFS

Language:AutoItNOASSERTION268 33 27

Mft2Csv

Extract $MFT record info and log it to a csv file.

Language:AutoItMIT250 22 12

LogFileParser

Parser for $LogFile on NTFS

Language:AutoItMIT182 21 4

ExtractUsnJrnl

Tool to extract the $UsnJrnl from an NTFS volume

Language:AutoItNOASSERTION103 13 7

UsnJrnl2Csv

Parser for $UsnJrnl on NTFS

Language:AutoItMIT100 16 1

SetMace

Manipulate timestamps on NTFS

Language:AutoItNOASSERTION44 5 5

EaTools

Analysis and manipulation of extended attribute ($EA) on NTFS

Language:AutoItNOASSERTION39 8 3

Indx2Csv

An advanced parser for INDX records

Language:AutoItNOASSERTION24 50

PowerMft

Powerful commandline $MFT record editor.

Language:AutoItMIT22 40

SectorIo

Kernel mode driver for writing to physical disk with SL_FORCE_DIRECT_WRITE

Language:C22 8 2

Secure2Csv

Decode security descriptors in $Secure on NTFS

Language:AutoItNOASSERTION20 4 1

NtfsFileExtractor

Extract files off NTFS

Language:AutoItNOASSERTION18 60

MftCarver

Carve $MFT records from a chunk of data (for instance a memory dump)

Language:AutoItNOASSERTION16 30

HideAndProtect

Makes files super hidden on NTFS

Language:AutoItNOASSERTION14 40

MftRcrd

Command line $MFT record decoder

Language:AutoItMIT11 5 2

StegoMft

PoC for hiding data within $MFT

Language:AutoItNOASSERTION11 30

IndxCarver

Carve INDX records from a chunk of data.

Language:AutoItNOASSERTION9 30

UsnJrnlCarver

Carving Usn pages (UsnJrnl records)

Language:AutoIt8 50

ExtractAllAttributes

Extracts all attributes of files on NTFS

Language:AutoItNOASSERTION6 30

RcrdCarver

Carve RCRD records ($LogFile) from a chunk of data.

Language:AutoItNOASSERTION5 40

MakeContainer

Tools to create special containers for patched VeraCrypt/TrueCrypt

Language:AutoItGPL-3.04 30

MakeImage

Create graphic bitmap from binary data.

Language:AutoIt4 30

HexDump

Dump binary data to console from file or disk

Language:AutoItNOASSERTION300

PartDump

Utility to dump basic volume information from a disk object.

Language:AutoItNOASSERTION3 3 1

RawDir

A low level dir command for NTFS volumes

Language:AutoItNOASSERTION3 40

Tiny_NTFS

Smallest possible size of a NTFS partition

NOASSERTION3 30

VeraCrypt

Tweaked version for supporting arbitrary offsets.

Language:CNOASSERTION1 30

Volsnap-Bug-Content

Content for a volsnap.sys bug analysis

Language:PowerShell1 20

MftRef2Name

Resolve file index number to name or vice versa on NTFS

Language:AutoItNOASSERTION040