A list of tools that I’ve created for use in Digital Investigations
USN Journal Extractor 2.0
A tool that allows you to extract Live and Deleted USN records from a mounted forensic image file or physical disk and places them in an SQLite database for easy searching and querying.
These are different templates that I have created to make manual review of hex structures easier:
SQLite Templates – Various SQLite templates, including those for Journal files are available below: