Your use of the packages on this site means you understand they are not supported or guaranteed in any way. Due to the nature of a public repository and unreliability due to distribution rights, these packages should not be used as is for organizational purposes either. Learn more.
-
C:\> choco install sandboxie.install
Sandboxie (Install) 5.24By:
A process sandbox helps to manage and limit access permissions a process has to your data. Use it to safely test new software for usability, safely study behavior of known spyware and malware, or browse the web from a sandboxed browser to completely shield your computer and network from Internet Bad Things. ### Features * Secure Web Browsing: Run... More information
-
C:\> choco install sandboxie Sandboxie 5.24By:
A process sandbox helps to manage and limit access permissions a process has to your data. Use it to safely test new software for usability, safely study behavior of known spyware and malware, or browse the web from a sandboxed browser to completely shield your computer and network from Internet Bad Things. ### Features * Secure Web Browsing: Run... More information
-
C:\> choco install ericzimmermantools Eric Zimmerman's tools 2.4.2.2By:
Installs tools for lnk files, jump lists, Registry hives, hashing, and much more
-
C:\> choco install timelineexplorer Timeline Explorer 0.8.5.0By:
Allows for instant filtering, searching, sorting, grouping, and contains a details view that makes reviewing complex entries much easier
-
C:\> choco install registryexplorer Registry Explorer 1.0.0.4By:
Supports recovery of deleted keys and values, multi hive support, the fastest searching, viewing slack space, plugin support, and much more
-
C:\> choco install shellbagsexplorer ShellBags Explorer 1.0.0.2By:
Comprehensive support for all known shell item types, exporting, filtering, sorting, file system detecion, and more!
-
C:\> choco install appcompat-cacheparser AppCompatCache parser 1.0.0.1By:
AppCompatCache parser used to show evidence of execution
-
C:\> choco install lecmd LECmd 1.0.0.0By:
LECmd supports all lnk file structures and exports to a wide variety of formats
-
C:\> choco install iisgeolocate iisGeolocate 1.3.0.0By:
Adds geolocation information to IIS logs and extracts all unique IP addresses from said logs to a file
-
C:\> choco install amcacheparser Amcache parser 1.0.0.3By:
Amcache parser with advanced features such as whitelisting, data reduction, and various export formats
-
C:\> choco install xwfim XWFIM 1.9.0.0By:
One click installation and updating of all X-Ways software including Forensics, Imager, and Investigator. Can also build portable installations, and validate installs
-
C:\> choco install pecmd PECmd 1.0.0.0By:
Fully parses Windows prefetch files (XP-Windows 10) and allows for exporting in a wide variety of formats, keyword hits in contents, etc. Windows 10 prefetch support requires running on Windows 8 or later
-
C:\> choco install jumplistexplorer JumpList Explorer 0.6.1.0By:
JumpList Explorer parses and allows for exporting details from custom and automatic destination jumplists. Allows for dumping all lnk files from jumplists, and more
-
C:\> choco install bstrings bstrings 1.3.0.0By:
Contains built in regex for searching for common things like URLs, emails, IPs, and more. Very fast and works against files of any size
-
C:\> choco install timeapp TimeApp 1.3.1.0By:
TimeApp is useful for testing when interacting with a system to have a record of when something happened. Recording the screen with TimeApp running allows for going back through a video to compare the actual time with various artifacts in the Registry and elsewhere
-
C:\> choco install sleuthkit sleuthkit 4.4.0By:
The Sleuth Kit: Forensics Tools
-
C:\> choco install hasher-erz Hasher 1.8.0.0By:
Hash files or entire directories using a wide variety of file hashes
-
C:\> choco install radare radare (Install) 2.6.0By:
Radare is a portable reversing framework that can... * Disassemble (and assemble for) many different architectures * Debug with local native and remote debuggers (gdb, rap, webui, r2pipe, winedbg, windbg) * Run on Linux, *BSD, Windows, OSX, Android, iOS, Solaris and Haiku * Perform forensics on filesystems and data carving * Be scripted in Python, ... More information
-
C:\> choco install netfoxdetective
NetfoxDetective 0.9.1By:
NFX Detective is a novel Network forensic analysis tool that implements methods for extraction of application content from communication using supported protocols.
-
C:\> choco install sdbexplorer SDB Explorer 0.5.1.1By:
SDB Explorer parses and allows for interacting with contents of SDB databases. View binary patch contents, dump strings, and more.
-
C:\> choco install mftecmd MFTECmd 0.2.8.0By:
MFTECmd exports to CSV and allows viewing of full entry details by entry/sequence #s