Windows 10/11 stuff

File	Description
Automatic/Custom Destinations, BagMRU & ShellLNK (LNK) Browser
$MFT directory tree reconstruction & FILE record browser
Background Activity Moderator (Win10 v1803/1809/1903)	Background Activity Service and registry entries. Powershell parsers & info.
PowerShell History (pdf)	PowerShell script to read the current user's log(s).
SQLite queries	Various sqlite queries (Browser data, Skype etc)
Cortana	Some notes on Cortana (pdf)
Desktop Icon Layouts	List of user desktop icon/shortcuts/files (registry) (pdf)
MS Edge Container permissions	MS Edge Access permissions (test notes)
MS Edge Containers	MS Edge container info (test notes) (pdf)
USB devices	USB device history in the registry (test notes) (pdf)
Unix Hex to Time conversion	Excel spreadsheet to convert UNIX dates in Hexadecimal to readable DateTime
Windows Installation and Upgrades	How to determine the original Windows Installation date. (pdf)
Zone.Identifier ADS view	PowerShell script to list Alternate Data Streams and view the Zone.Identifier ADS contents of files in the selected folder/subfolders. More info at Phill Moore's blog and at [Hacking Exposed](http://www.hecfblog.com/2018/06/daily-blog-402-solution-saturday-62318.html. Also, powerShell script to list Files/Folders that are HardLinks or Junction Points.
Windows 10 Timeline (Win10 v1803/1809/1903)	Analysis of Windows 10 timeline feature. SQLite queries, Powershell scripts & info.
Windows 10 Notifications	SQLite query of the (Push) Notifications dB, Powershell scripts & other info
Windows 10 Sticky Notes	SQLite query and info
Windows 10 (v1809/1903): YourPhone app	SQLite query to view the Contacts & SMS Messages plus info.
Windows 10 event log parsers	PowerShell scripts to read live or offline Windows event log(s), Eventlog keyword lists, OpCodes etc.
Windows 10 AmCache.hve parser	PowerShell scripts to parse the AmCache hive.
Windows 10 Search JumpList	PowerShell script to parse the Windows 10 'Search JumpList' entries
NTFS ObjectIDs	powershell script listing the NTFS $MFT ObjectID's of files in selected Folder & subfolders. Powershell script to parse a local or mounted drive and save the $USN journal to a comma separated file. Also, a script to get NTFS information from a local or mounted drive and get user readable results. All three use Windows's "fsutil.exe" command.
Windows Diagnostics Infrastructure	Powershell script that uses Microsoft TraceRpt.Exe to convert all Event Trace Logs (.ETL) of the target "\Windows\System32\WDI" folder to the respective summary.txt and eventlog.csv (comma separated file). It also copies the StartupInfo folder and it's contents.
Office Document Cache	PowerShell scripts & EXEs to parse MS Office ..stuff :)
Windows Media Player Library Metadata parser	Windows Media Player Library Metadata parser
Win 11 Program-Compatibility parser