EricRZimmerman 

Offline Registry hive parser, including transaction log support

GUIDs to descriptions

ExtensionBlocks

Parses Windows shortcut files

$MFT Parser

Parses Windows jumplists (automatic and custom destinations)

Parses OLECF containers

Parses Windows event logs (evtx format)

Just some nice helpers

$I30 parser

USN $J parser

$SDS parser

Boot parser

RegistryPluginBase. Use this to create your own Registry Explorer plugins!

Parses Windows SDB files

Windows Prefetch parser. Supports all known versions from Windows XP to Windows 11

O Parser

Shell item related extension blocks

Parses Amcache hives

Package Description