Files - Miscellaneous (40)

Detect It Easy (DIE) is a packer identifier in order to help define a file type. Comes in handy to analyze a file, determine its type and packer.

pestudio shows details about applications and other system files (.exe, .dll, .cpl, .ocx, .ax, .sys etc.) without starting them including:

• Libraries that are used by an application
• Functions that are imported by an application
• Functions (also anonymous) that are exported by an application
• All functions that are forwarded to other libraries
• Obsolete Functions that are exported and imported by an application
• If Data Execution Prevention (DEP) Windows security mechanism is used
• If Address Space Layout Randomization (ASLR) Windows security mechanism is used
• If Windows security mechanism Structured Exception Handling (SEH) is used
• Whether some sections are compressed

PEAnatomist shows almost all known data structures inside a PE file and makes some analytics.
Current version provides an entropy histogram possibly handy for cursory PE forensics

PPEE (Professional PE file Explorer) allows analysis of malformed and crafted PE files, making it handy for reverse-engineering, malware researchers and more. The program includes PE Export, Import, Resource, Exception, Certificate (relies on Windows API), Base Relocation, Debug, TLS, Load Config, Bound Import, IAT, Delay Import and CLR.

The program includes a HEX editor and supports Virustotal and OPSWAT's Metadefender query reports.

QuickWayToFolders provides quick and easy access to a folder on your computer via a taskbar icon. The program window disappears when you click outside the window. Display modes include:

• Desktop: Act like a mini-desktop, with small icons
  
• Small Browser: very similar to Windows explorer in "details" view
  
• Menu: Display folder content in a menu
• Multiple Folders Menu: Display multiple folders content in a single menu (note that you must manually add them or nothing will appear when you click the icon)
  

OpenedFilesView displays the list of all opened files on your system. For each opened file, the handle value, read/write/delete access, file position, the process that opened the file etc. are displayed. You can also close one or more opened files, or terminate the processes that opened these files. This is particularly handy when you are trying to delete/move/open a file and Windows complains that the file is "locked".

NonCompressibleFiles is a testing program that allows you to create on the fly one or more non-compressible files, or maximum compressible files. Can be used to test performance of compression programs, to find out if data transfer programs (such as FTP) are compressing the data, or test file behavior.

ESEDatabaseView reads and displays the data stored inside a database used by a variety of Microsoft programs known as Extensible Storage Engine (ESE) database (aka Jet Blue or a .edb file). It displays a list of all tables available in the opened database file, allows you to choose the desired table to view, and then when you choose a table, it displays all records found in the selected table.

The program also allows you to easily choose one or more records, and then export them into a variety of formats including CSV, HTML and XML, or copy and then paste them into a spreadsheet program.

PropertySystemView allows you view and modify the properties of file from GUI and command-line, using the property system of Windows operating system. For example, you can change the 'Media Created' timestamp stored in .mp4 files (System.Media.DateEncoded) as well as other metadata stored in media files and office documents, like Title, Comments, Authors, Tags, Date Acquired, Last Saved Date, Content Created Date, Date Imported, Date Taken (EXIF of .jpg files), and more.

PropertySystemView also allows you to set properties of Windows. For example, you can set the System.AppUserModel.ID property of a window in order to disable the taskbar grouping of the specified window.

OpenSaveFilesView displays the list of files that you previously opened with the standard Windows open/save dialog-box. The program shows a variety of details including filename, extension, order (the order that the files were opened for every file extension), open time (available only for the last opened file of every file type), file modified/created time, file size and file attributes.

NTFSLinksView shows you a list of all symbolic links and junctions in the specified folder, and their target paths. Microsoft Windows uses symbolic links and junction points of NTFS file system in order to make changes in the folders structure of Windows and keep the compatibility of applications written for older versions (pre-Vista). The program is useful for both diagnosis around linking issues and developers seeking to use symbolic links in their tools.

Shortcuts Search And Replace is a tool for system shortcuts that lets you:

• Search for shortcuts target path, working directory, arguments, and icon location content.
• Replace multiple shortcuts' target paths, working directories, arguments, and icon location content (useful if you move portable applications paths or directory).
• Search for dead links to resolve or delete them (multiple resolves/delete in one click).

File Joiner easily combines multiple files into one. Often files are separated into parts using a program like HJSplit (ending with .001, .002, .003, etc.) so they can be sent over email, newsgroup or other hosting service that limits file size.

ITN Converter (a.k.a. ITNConv) is both a route converter supporting many formats as well as a simple and efficient route planner.

The converter supports route file formats (roadbook) from many GPS or mapping software such as TomTom, Navigon, Garmin, MapPoint or MapSource. This converter can easily transfer a route created by a GPS or mapping software to another so you can download routes from many web sites and convert it to the file format supported by your hardware.

MiTeC Icon Explorer allows to browse, search, extract and manage standalone icons, icon libraries and executable that contains icons as resources. It searches specified path with directory recursion and examines any file if it contains any icon and then extract it. Icons can be saved as icons, icon libraries, individual icon images or bitmaps.

JumpListsView displays the information stored by the 'Jump Lists' feature available when you right-click on something in the task bar in Windows 7 - 10. For every record found, data available includes the filename that the user opened, the date/time, the ID of the application, the size/time/attributes of the file on the time that the file was opened etc.

You can also export the Jump Lists records to csv/tab-delimited/xml/html file.

SigcheckGUI is a system and security analysis tool for understanding files and processes. The program shows a variety of file data including signing source, 32/64-bit status, version, publisher, and more. Security options include VirusTotal analysis and file hashing (MD5, SHA1, and SHA256). The program can even run on all active processes.

The program can export results to spreadsheet (CSV) or copied to the clipboard.

SigcheckGUI is a front-end for Sigcheck from Sysinternals.

Folders Popup lets you move easily between frequently used folders within save dialogs. Click the middle mouse button to access your favorite folders within the menu.

A 64-bit version is included in the download.

Search and Delete is a lightweight tool scanning one or more folders from various sources for files. The program can then rename the file extension, delete the file, or replace it with one you provide. Search results can be saved and loaded later.

Great for system administrators who need to update multiple specific files.

ExifToolGUI is a tool for viewing/editing metadata inside a long list of file types including document, audio, video, image, PDF, and more. For images, the program can both view and edit metadata information such as camera/device used, settings on the device, and even map the location the picture was taken if the camera has GPS capability. The program also supports IPTC and XMP tags, has batch capability, and can import/export all tags.

For privacy (and file size), the program can remove all metadata from selected files.

The program is a front-end for the cross-platform ExifTool. It extracts the content of ExifTool.exe to a temp folder under the user's folder, along with thumbs, if enabled.

Delete After Days functions as a delayed removal tool to help avoid the problems of a standard delete function. Files and folders may be dropped into a standard desktop trash icon, whereupon the program will prompt for a time before its removal (1, 6, or 12 months).

Useful for making doubly sure you don't need a file, ongoing system cleanup, or for general system upkeep. Note that the program will not delete files that are copied or moved and must be running to delete expired files.

ResourcesExtract is a small utility that extracts all resources from dll/ocx/exe files. These include bitmaps, icons, cursors, AVI movies, HTML files, and more. The program can search subfolders and export BMP files as PNG.

Earl allows you to convert .URL files into standard Window shortcut files (.LNK). This can be helpful if you use an application that doesn't understand .URL files but does understand standard Windows shortcuts. For instance, some icon docks won't handle a .URL file dropped on them, but can work with regular Windows shortcuts.

TreeCopy is a unique directory copier taking the various folders the source folder to a set of empty target folders. Its unique from similar tools as it copies only the directory structure and not the files. This is useful for developers and in testing.

This functionality is similar to the windows command line "xcopy" i.e. XCOPY source [destination] /T /E, but this tool allows this action without needing to remember command line switches.

Watch 4 Folder is a simple, lightweight tool for monitoring folder and file activities. The program can monitor 12 different types of events, execute a program or batch file, or show a pop-up message in case of an event. The program can also write to a text log file and allow the user to watch it's changes live.

The free version is limited to monitoring a single folder.

BinText is a file text scanner / extractor that helps find character strings buried in binary files. The program can extract text from any kind of file and display plain ASCII text, Unicode (double byte ANSI) text, as well as Resource strings. Additional useful information for each item is included in the "Advanced" mode. Uniquely, the program will show both the file offset and the memory offset of each string found.

Although primarily targeted for programmers, it can be used by anyone interested in ferreting out character strings buried within binary files.

Note: Although updated versions of the program exist, the 3.00 version is listed for reasons described in forums.

Zero Zipper takes a selected folder and sub-folders and creates the same structure in a zip file, but without data. The program allows the replication of a complex folder structure for testing purposes.

Belvedere is an automated file management tool that works between two or more directories. It allows you to create advanced, multi-level rules to move, copy, delete, rename, or open files based on their name, extension, size, creation date, and more. Also allows for compression, recursive (all files and subfolders) copy, as well as recycle bin management.

Note: The program processes files based on a variable number of milliseconds. By default, this is set to 3,000,000 milliseconds, or 50 minutes. Modify the Sleeptime under Preferences for more or less frequent changes. For example, for every 24 hours, enter 86,400,000, for every minute, enter 60,000, or for instant change, enter 100.

FileFiller lets you create dummy files at (almost) any size. The file's contents can be pseudo-random, filled with zeros or with characters, whose ordinal value you can specify.

Remove Empty Folders is a simple tool to delete empty folders below a given directory. The program previews deletes before actually removing any empty folders (you must uncheck Test Only).

ExeInfo shows general information about executable files (*.exe), dynamic-link libraries (*.dll), ocx files, and drivers files. It can recognize all major types of executables, including MS-DOS files, New Executable files (16-bit) and Portable Executable files (32-bit).

IconsExtract scans the files and folders on your computer, and extract the icons and cursors stored in EXE, DLL, OCX, CPL, and in other file types. You can save the extracted icons to ICO files (or CUR files for cursors), or copy the image of a single icon into the clipboard.

Open++ is a context-menu shell extension that allows you to quickly open selected files or folders with customizable commands.

Note: Main site offline -- linking to archive.org.

Version Info will view, export and import version info of executable files. It completely supports multilingual version info structures (Windows file properties dialog does not show multiple languages). Files can be open by using Open file dialog box, history list, or using mouse drag and drop. Support The following file types:

Application (*.exe)
MS-DOS application (*.com)
Application extension (*.dll)
Screen saver (*.scr)
Device driver (*.drv)
System driver (*.sys)
Audio compression manager driver (*.acm)
Audio/Video codec (*.ax)
Service provider (*.tsp)
Type library (*.tlb)
ActiveX control (*.ocx)
Object library (*.olb)
Control panel library (*.cpl)
Font (*.fon)
Borland package (*.bpl)
Delphi package (*.dpl)

Limitations: Import option and "Memory on Demand" options available only if using NT, 2000 or XP.

Deletist allows you to delete files and folders sourced from a text file containing their full paths.

Written in AutoHotkey.

Note: Both Deletist.exe and the Deletist process appear as a threat in Ad-Aware. This is believed to be a false positive.

MoveOut uses rules to move files from the desktop to a subfolder, based on file type, part of a file name, or whatever. Have it ask to replace existing files, or rename them. It can also ignore files.

Written in AutoHotkey.

Size Matters allows you to easily track lists of files and their sizes.

Written in AutoHotkey.

iBin provides a Recycle Bin-type functionality for removable devices, giving the user an opportunity to restore deleted files. Can only be run from a removable device.

File Sieve is a small tool that can take the files from a directory and copy or move them into a new folder, while creating subfolders from A-Z and sorting the files into them based on their name (first letter). The program can come in handy if you want to organize files for archiving, or to put them on a CD.