Win 10/11 related research
Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.
A cross-platform DFIR tool for parsing Windows IconCache.db artifacts, recovering historical file paths, and enriching forensic evidence with Amcache data.
FAEP is an automated tool to extract and parse forensic artifacts from .E01 images automatically, with a clean GUI and minimal manual effort.
X-Ways Forensics Community Edition
Enable constraint-based AI workflows and reliable prompt engineering for GitHub Copilot using hypervelocity engineering methods and validated outputs.
Fleet/osquery extension that parses Windows Amcache.hve in place, even while locked, as seven SQL tables for live DFIR
FAEP is an automated tool to extract and parse forensic artifacts from .E01 images automatically, with a clean GUI and minimal manual effort.
C++ Amcache forensic parser for Windows program execution artifacts
Python-based DFIR utilities for extracting and deduplicating SHA-1 hashes from Windows Amcache CSV exports and preparing batches for malware reputation analysis.
Cross-platform Windows Amcache.hve parser with comprehensive metadata and text, CSV, JSON, and JSONL output.
To associate your repository with the amcache topic, visit your repo's landing page and select "manage topics."