[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Full-Disclosure] Re: Windows Registry Analzyer


  Yes, absolutely.  It's called "InCtrl5" and it is *exactly* what you both
want.

Found it :

http://publicdata.home.comcast.net/inctrl5.zip

Also note : this is Plugin #56 on PartPE (which would be quite useful for forensics -- you could boot the undisturbed system under BART, grab a snapshot, do (x), and grab a comparison snapshot agian under BART -- thus avoiding all the other volitle crud that changes between Windows reboots).


~Mike.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html