
amcache-evilhunter
Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.
digital-forensicsforensicsincident-response+2
113

Parse and analyze a Windows Amcache.hve registry hive, VirusTotal integration.

Python tool that parses the NTFS $MFT to copy locked files during incident response, bypassing OS locks by reading raw disk locations. Supports…