{"id":13596551,"url":"https://github.com/kacos2000/Win10","last_synced_at":"2025-04-09T16:33:07.268Z","repository":{"id":46037046,"uuid":"137331309","full_name":"kacos2000/Win10","owner":"kacos2000","description":"Win 10/11 related research","archived":false,"fork":false,"pushed_at":"2023-12-19T12:49:10.000Z","size":38856,"stargazers_count":183,"open_issues_count":0,"forks_count":33,"subscribers_count":22,"default_branch":"master","last_synced_at":"2025-03-27T01:12:20.712Z","etag":null,"topics":["amcache","bam","dfir","eventlog","events","forensic","jumplist","keyword-lists","keywords","mediaplayer-library","notifications","objectid","sticky-notes","timeline","wdi","win10","win11","windows","xml","yourphone"],"latest_commit_sha":null,"homepage":"https://kacos2000.github.io/Win10/","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kacos2000.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null},"funding":{"github":"kacos2000"}},"created_at":"2018-06-14T08:45:38.000Z","updated_at":"2025-03-12T07:01:50.000Z","dependencies_parsed_at":"2023-02-15T12:16:07.932Z","dependency_job_id":"6131c26f-55e3-4ccd-b2c3-3abecab1f0a0","html_url":"https://github.com/kacos2000/Win10","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FWin10","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FWin10/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FWin10/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FWin10/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kacos2000","download_url":"https://codeload.github.com/kacos2000/Win10/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248067980,"owners_count":21042395,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["amcache","bam","dfir","eventlog","events","forensic","jumplist","keyword-lists","keywords","mediaplayer-library","notifications","objectid","sticky-notes","timeline","wdi","win10","win11","windows","xml","yourphone"],"created_at":"2024-08-01T16:02:34.086Z","updated_at":"2025-04-09T16:33:02.245Z","avatar_url":"https://github.com/kacos2000.png","language":"PowerShell","readme":"\u003c!-- saved from url=(0044) https://kacos2000.github.io/Win10/ --\u003e \n## Windows 10/11 stuff ##\n\n| **File**                         |**Description**\n| :--------                        |     :---    \n|[Automatic/Custom Destinations, BagMRU \u0026 ShellLNK (LNK) Browser](https://github.com/kacos2000/Jumplist-Browser)| \u003cimg src=\"https://github.com/kacos2000/Win10/assets/11378310/4bd0394f-955d-4969-a83b-f0bc68619389\" width=\"300\"\u003e\n|[$MFT directory tree reconstruction \u0026 FILE record browser](https://github.com/kacos2000/MFT_Browser)| \u003cimg src=\"https://user-images.githubusercontent.com/11378310/211606446-1213ff95-a8f8-4a7a-9691-e24931b9f69b.png\" width=\"300\"\u003e\n|[Background Activity Moderator (Win10 v1803/1809/1903)](https://github.com/kacos2000/Win10-Research/blob/master/Bam/readme.md) |![Bam preview](bam.jpg) \u003cbr\u003eBackground Activity Service and registry entries. Powershell parsers \u0026 info.\n|[PowerShell History (pdf)](ConsoleHost_history.pdf) |[PowerShell script](https://github.com/kacos2000/Win10/blob/master/PS-History.ps1) to read the current user's log(s).\n|[SQLite queries](https://github.com/kacos2000/queries/blob/master/README.md) |Various sqlite queries *(Browser data, Skype etc)*\n|[Cortana](Cortana.pdf) |![Cortana preview](cortana.jpg) \u003cbr\u003eSome notes on Cortana *(pdf)*\n|[Desktop Icon Layouts](Desktop_IconLayouts.pdf) |![Desktop preview](desktop.jpg) \u003cbr\u003eList of user desktop icon/shortcuts/files (registry) *(pdf)*\n|[MS Edge Container permissions](Edge_AccessEnum_AC.xlsx) |MS Edge Access permissions *(test notes)*\n|[MS Edge Containers]('MS%20Edge%20AC.pdf') |MS Edge container info *(test notes)* *(pdf)*\n|[USB devices](USB_device.pdf) |USB device history in the registry *(test notes)* *(pdf)*\n|[Unix Hex to Time conversion](Unix_Hex-Time_Calc.xlsx) |Excel spreadsheet to convert UNIX dates in Hexadecimal to readable DateTime\n|[Windows Installation and Upgrades](Windows%20install%20date%20-%20registry.pdf) |![Upgrades preview](upgrades.jpg)\u003cbr\u003eHow to determine the original Windows Installation date. *(pdf)*\n|[Zone.Identifier ADS view](https://github.com/kacos2000/Win10-Research/blob/master/ads_streams/readme.md) |![Powershell preview](https://raw.githubusercontent.com/kacos2000/Win10-Research/master/ads_streams/s_results.JPG) \u003cbr\u003ePowerShell script to list Alternate Data Streams and view the Zone.Identifier ADS contents of files in the selected folder/subfolders.  More info at [Phill Moore's blog](https://thinkdfir.com/2018/06/17/zone-identifier-kmditemwherefroms/) and at [Hacking Exposed](http://www.hecfblog.com/2018/06/daily-blog-402-solution-saturday-62318.html. Also, powerShell script to list Files/Folders that are HardLinks or Junction Points.\n|[Windows 10 Timeline (Win10 v1803/1809/1903)](https://kacos2000.github.io/WindowsTimeline/) |Analysis of Windows 10 timeline feature.\u003cbr\u003e SQLite queries, Powershell scripts \u0026 info.\n|[Windows 10 Notifications](https://github.com/kacos2000/Win10-Research/blob/master/Notifications/readme.md)| SQLite query of the *(Push)* Notifications dB, Powershell scripts \u0026 other info\n|[Windows 10 Sticky Notes](https://github.com/kacos2000/Win10/blob/master/StickyNotes/readme.md)|SQLite query and info\n|[Windows 10 *(v1809/1903)*: YourPhone app](https://github.com/kacos2000/Win10/blob/master/YourPhone/readme.md)| SQLite query to view the Contacts \u0026 SMS Messages plus info.\n|[Windows 10 event log parsers](https://github.com/kacos2000/Win10-Research/blob/master/EventLogs/readme.md)| PowerShell scripts to read  live or offline Windows event log(s), Eventlog keyword lists, OpCodes etc.\n|[Windows 10 AmCache.hve parser](https://github.com/kacos2000/Win10-Research/blob/master/AmCache/readme.md)| PowerShell scripts to parse the AmCache hive.\n|[Windows 10 Search JumpList](https://github.com/kacos2000/Win10-Research/blob/master/JumpList/readme.md)| PowerShell script to parse the Windows 10 '**Search JumpList**' entries\n|[NTFS ObjectIDs](https://github.com/kacos2000/Win10/blob/master/ObjectID/readme.md)| powershell script listing the NTFS $MFT ObjectID's of files in selected Folder \u0026 subfolders. Powershell script to parse a local or mounted drive and save the $USN journal to a comma separated file. Also, a script to get NTFS information from a local or mounted drive and get user readable results. All three  use  Windows's \"fsutil.exe\" command.\n|[Windows Diagnostics Infrastructure](https://github.com/kacos2000/Win10/blob/master/WDI/Readme.md)| Powershell script that uses Microsoft TraceRpt.Exe to convert all Event Trace Logs (.ETL) of the target \"\\Windows\\System32\\WDI\" folder to the respective summary.txt and eventlog.csv (comma separated file). It also copies the StartupInfo folder and it's contents. \n|[Office Document Cache](https://github.com/kacos2000/Other/blob/master/OfficeFileCache/Readme.md)| ![OfficeFileCache](https://raw.githubusercontent.com/kacos2000/Other/master/OfficeFileCache/OfficeFileCacheFSD.JPG)PowerShell scripts \u0026 EXEs to parse MS Office ..stuff :)\n|[Windows Media Player Library Metadata parser](https://github.com/kacos2000/Win10/blob/master/WindowsMediaPlayer/readme.md)| ![wmpl](https://raw.githubusercontent.com/kacos2000/Win10/master/WindowsMediaPlayer/wmpl.JPG) Windows Media Player Library Metadata parser\n[Win 11 Program-Compatibility parser](https://github.com/kacos2000/Win10/blob/master/ProgramCompatibility/readme.md)|![image](https://user-images.githubusercontent.com/11378310/213304751-fd5db833-b565-4496-a79f-12055b67cab7.png)\n\n\n","funding_links":["https://github.com/sponsors/kacos2000"],"categories":["PowerShell","Operating Systems"],"sub_categories":["Windows"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkacos2000%2FWin10","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkacos2000%2FWin10","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkacos2000%2FWin10/lists"}