EricRZimmerman 

Offline Registry hive parser, including transaction log support

GUIDs to descriptions

ExtensionBlocks

Parses Windows shortcut files

$MFT Parser

Parses Windows jumplists (automatic and custom destinations)

Parses OLECF containers

Parses Windows event logs (evtx format)

Just some nice helpers

$I30 parser

USN $J parser

$SDS parser

Boot parser

RegistryPluginBase. Use this to create your own Registry Explorer plugins!

Parses Windows SDB files

O Parser

Windows Prefetch parser. Supports all known versions from Windows XP to Windows 11

Shell item related extension blocks

Parses Amcache hives

Package Description