Files - Miscellaneous (40)

MiTeC EXE Explorer reads and displays executable file properties and structure. It is compatible with PE32 (Portable Executable), PE32+ (64bit), NE (Windows 3.x New Executable) and VxD (Windows 9x Virtual Device Driver) file types, as well as .NET executables.

The program identify compiler and packer/protector, enumerates introduced classes, used units and forms for files compiled by Borland compilers. It contains powerfull Resource Viewer that is able to abalyze and display all basic resouce types and some extra ones as JPEG, PNG, GIF, AVI, REGISTRY and Type Library viewer that enumerates all objects and creates import interface unit in Object Pascal language. Every type of resource can be saved to file.

Program data can be output to a text report.

PropertySystemView allows you view and modify the properties of file from GUI and command-line, using the property system of Windows operating system. For example, you can change the 'Media Created' timestamp stored in .mp4 files (System.Media.DateEncoded) as well as other metadata stored in media files and office documents, like Title, Comments, Authors, Tags, Date Acquired, Last Saved Date, Content Created Date, Date Imported, Date Taken (EXIF of .jpg files), and more.

PropertySystemView also allows you to set properties of Windows. For example, you can set the System.AppUserModel.ID property of a window in order to disable the taskbar grouping of the specified window.

Shortcuts Search And Replace is a tool for system shortcuts that lets you:

• Search for shortcuts target path, working directory, arguments, and icon location content.
• Replace multiple shortcuts' target paths, working directories, arguments, and icon location content (useful if you move portable applications paths or directory).
• Search for dead links to resolve or delete them (multiple resolves/delete in one click).

Detect It Easy (DIE) is a packer identifier in order to help define a file type. Comes in handy to analyze a file, determine its type and packer.

ESEDatabaseView reads and displays the data stored inside a database used by a variety of Microsoft programs known as Extensible Storage Engine (ESE) database (aka Jet Blue or a .edb file). It displays a list of all tables available in the opened database file, allows you to choose the desired table to view, and then when you choose a table, it displays all records found in the selected table.

The program also allows you to easily choose one or more records, and then export them into a variety of formats including CSV, HTML and XML, or copy and then paste them into a spreadsheet program.

PEAnatomist shows almost all known data structures inside a PE file and makes some analytics. Current version provides an entropy histogram possibly handy for cursory PE forensics.

Linking to Internet Archive.

ExifToolGUI is a tool for viewing/editing metadata inside a long list of file types including document, audio, video, image, PDF, and more. For images, the program can both view and edit metadata information such as camera/device used, settings on the device, and even map the location the picture was taken if the camera has GPS capability. The program also supports IPTC and XMP tags, has batch capability, and can import/export all tags.

For privacy (and file size), the program can remove all metadata from selected files.

The program is a front-end for the cross-platform ExifTool. It extracts the content of ExifTool.exe to a temp folder under the user's folder, along with thumbs, if enabled.

Note: This program was originally created by Bogdan Hrastnik, but has been updated to v6.x by Frank Bijnen on GitHub. The instructions to create a portable assembly with all its dependencies is rather involved (and can be found on the releases page), so I am just pointing to the PortableApps 32-bit version in this entry. A 64-bit yaP version can also be found in the forum topic for this program.

NTFSLinksView shows you a list of all symbolic links and junctions in the specified folder, and their target paths. Microsoft Windows uses symbolic links and junction points of NTFS file system in order to make changes in the folders structure of Windows and keep the compatibility of applications written for older versions (pre-Vista). The program is useful for both diagnosis around linking issues and developers seeking to use symbolic links in their tools.

pestudio shows details about applications and other system files (.exe, .dll, .cpl, .ocx, .ax, .sys etc.) without starting them including:

• Libraries that are used by an application
• Functions that are imported by an application
• Functions (also anonymous) that are exported by an application
• All functions that are forwarded to other libraries
• Obsolete Functions that are exported and imported by an application
• If Data Execution Prevention (DEP) Windows security mechanism is used
• If Address Space Layout Randomization (ASLR) Windows security mechanism is used
• If Windows security mechanism Structured Exception Handling (SEH) is used
• Whether some sections are compressed