wapowell
DFIR Analyst, Expert Witness, McRib and McFish connoisseur, Lifter of heavy things... All opinions expressed are my own.
Orlando, FL
Pinned Repositories
MFTEntryCarver
Carve files for MFT entries (eg. blkls output or memory dumps). Recovers filenames (long & short), timestamps ($STD & $FN) and data if resident. It will also parse half broken entries as long as at least one $FN entry is ok.
net-creds
Sniffs sensitive data from interface or pcap
wapowell's Repositories
wapowell/MFTEntryCarver
Carve files for MFT entries (eg. blkls output or memory dumps). Recovers filenames (long & short), timestamps ($STD & $FN) and data if resident. It will also parse half broken entries as long as at least one $FN entry is ok.
wapowell/net-creds
Sniffs sensitive data from interface or pcap