Files - Miscellaneous (40)

PEAnatomist shows almost all known data structures inside a PE file and makes some analytics.
Current version provides an entropy histogram possibly handy for cursory PE forensics

PPEE (Professional PE file Explorer) allows analysis of malformed and crafted PE files, making it handy for reverse-engineering, malware researchers and more. The program includes PE Export, Import, Resource, Exception, Certificate (relies on Windows API), Base Relocation, Debug, TLS, Load Config, Bound Import, IAT, Delay Import and CLR.

The program includes a HEX editor and supports Virustotal and OPSWAT's Metadefender query reports.

QuickWayToFolders provides quick and easy access to a folder on your computer via a taskbar icon. The program window disappears when you click outside the window. Display modes include:

• Desktop: Act like a mini-desktop, with small icons
  
• Small Browser: very similar to Windows explorer in "details" view
  
• Menu: Display folder content in a menu
• Multiple Folders Menu: Display multiple folders content in a single menu (note that you must manually add them or nothing will appear when you click the icon)
  

OpenedFilesView displays the list of all opened files on your system. For each opened file, the handle value, read/write/delete access, file position, the process that opened the file etc. are displayed. You can also close one or more opened files, or terminate the processes that opened these files. This is particularly handy when you are trying to delete/move/open a file and Windows complains that the file is "locked".

NonCompressibleFiles is a testing program that allows you to create on the fly one or more non-compressible files, or maximum compressible files. Can be used to test performance of compression programs, to find out if data transfer programs (such as FTP) are compressing the data, or test file behavior.

ESEDatabaseView reads and displays the data stored inside a database used by a variety of Microsoft programs known as Extensible Storage Engine (ESE) database (aka Jet Blue or a .edb file). It displays a list of all tables available in the opened database file, allows you to choose the desired table to view, and then when you choose a table, it displays all records found in the selected table.

The program also allows you to easily choose one or more records, and then export them into a variety of formats including CSV, HTML and XML, or copy and then paste them into a spreadsheet program.

Detect It Easy (DIE) is a packer identifier in order to help define a file type. Comes in handy to analyze a file, determine its type and packer.

PropertySystemView allows you view and modify the properties of file from GUI and command-line, using the property system of Windows operating system. For example, you can change the 'Media Created' timestamp stored in .mp4 files (System.Media.DateEncoded) as well as other metadata stored in media files and office documents, like Title, Comments, Authors, Tags, Date Acquired, Last Saved Date, Content Created Date, Date Imported, Date Taken (EXIF of .jpg files), and more.

PropertySystemView also allows you to set properties of Windows. For example, you can set the System.AppUserModel.ID property of a window in order to disable the taskbar grouping of the specified window.

OpenSaveFilesView displays the list of files that you previously opened with the standard Windows open/save dialog-box. The program shows a variety of details including filename, extension, order (the order that the files were opened for every file extension), open time (available only for the last opened file of every file type), file modified/created time, file size and file attributes.