[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: michael.holstein at csuohio.edu (Michael Holstein)
Subject: Re: Windows Registry Analzyer
> Yes, absolutely. It's called "InCtrl5" and it is *exactly* what you both
> want.
Found it :
http://publicdata.home.comcast.net/inctrl5.zip
Also note : this is Plugin #56 on PartPE (which would be quite useful
for forensics -- you could boot the undisturbed system under BART, grab
a snapshot, do (x), and grab a comparison snapshot agian under BART --
thus avoiding all the other volitle crud that changes between Windows
reboots).
~Mike.
Powered by blists - more mailing lists