This history information includes the URLs that user visited, the Web site title.

In the following section, you can find a list of NirSoft utilities which have the ability.

If there will be enough demand from forensics examinerscompanies.

BrowsingHistoryView extracts browsing history information from all major Web browsers, including Firefox, Chrome, Opera, Internet Explorer, Microsoft Edge.

In order to extract the browsing history from external drive, you should use the Load history from the specified profiles folder option or the Load history from the specified profile option or.

CredentialsFileView decrypts and displays the passwords and other data stored inside Credentials files of Windows.

Windows operating system stores the following information inside Credentials files.

In order to decrypt the data stored inside Credentials file on external drive, you have to know the login password of the user.

In the Credentials Decryption Options window, you have to choose the Decrypt Credentials files of any system option and then choose the drive letter of the.

VaultPasswordView decrypts and displays the passwords and other data stored inside Windows Vault.

Windows operating system stores the following information inside Windows Vault.

In order to decrypt the data stored inside Windows Vault files on external drive, you have to know the login password of the user.

In the Vault Decryption Options window, you have to choose the Decrypt vault files of any system option and then choose the drive letter of the.

DataProtectionDecryptor is a powerful tool for Windows that allows you to decrypt passwords and other information encrypted by the DPAPI (Data Protection API) system of Windows operating system.

Heres some examples for passwords and other data encrypted with DPAPI.

In order to decrypt the DAPI data stored on external drive, choose the Decrypt DPAPI data from external drive or another user option in the DPAPI Decryption Options window.

You may also need to provide the logon password of the user if the password was used to decrypt the data.

DataProtectionDecryptor can read the DPAPI data for decryption from files or from text you type in hex-dump format (For example: 01 00 00 00 D0 8C 9D DF 01 15 D1 11 8C 7A 00 C0 4F C2 97 EB.

WirelessKeyView decrypts the wireless network keys stored by Windows operating system.

In order to decrypt wireless keys stored on external drive, open the Advanced Options window (F9).

FullEventLogView displays the details of all events from the event log of Windows (Including the event description).

You can load multiple event log files and watch all of them in a single table.

In order to watch events from external drive, you have to open the Choose Data Source window (F7), select the Load events from external folder with log files option and then.

IEHistoryView extracts information from the history file (index.dat) of Internet Explorer.

Pc Forensics Software