The following tools are currently in development stage. They don't have their own icons, there is no screenshot, there is no help file, and there are no translations, only a short description is available.
If you choose to download and try to use them, do it with extreme caution, and of course it's at your own risk !!
The zip files are password-protected. The password to extract the files is SoftNirPre987@
Pre-release NirSoft Tools
The ManageWirelessNetworks tool is an alternative to the standard 'Manage Wireless Networks' window provided by Windows operating system.
It allows you to view the details of all wireless profiles on your system, even if the network adapter is not connected.
For every wireless profile, the following information is displayed: Profile Name, SSID, Connection Type, Connection Mode, Authentication, Encryption, Key Type,
Auto Switch (Yes/No), Non Broadcast (Yes/No), Profile Position, Created Time, Modified Time, Wireless Key, and more...
You can edit a single wireless profile with the standard profile editor of Windows (Edit Wireless Profile - F2), as well as you can edit the XML of the wireless profile (For advanced users only !).
You can also quickly switch some settings of multiple profiles at once: Switch between manual and automatic mode, and switch between WPAPSK/WPA2PSK/AES/TKIP modes.
Be aware that at this time you can only change wireless profiles that their network interface is active.
This tool works on any version of Windows, starting from Windows Vista and including Windows 10.
The TCPConnectProblemView tool monitors the TCP connections on your system and displays an alert when a software tries initiate a TCP connection and there is no response
after a few seconds. When a problem with a TCP connection is detected , TCPConnectProblemView adds a new entry with the following information:
Process Name, Process ID, Detected On (date/time), Local Port, Local IP, Remote Port, Remote IP, Remote Host.
Optionally you use TCPConnectProblemView in tray icon mode, and when a problem with TCP connection is detected, it'll be displayed in a tray balloon.
DNSLookupView is a DNS tracing tool for Windows 10 that allows you to view the details of every DNS query sent through the DNS Client service of Windows.
For every DNS lookup, the following information is displayed: Host Name, Query Type (A, AAAA, and so on), Query Status (Error or succeeded), Query Result, Query Timestamp,
ID and name of the process that requested the DNS lookup.
Be aware that this tool doesn't work on Windows 7 and older systems, because extensive DNS tracing is not supported on these systems.
OutlookAccountsView displays the details of POP3/IMAP/SMTP accounts configured in Microsoft Outlook.
For every account, the following information is displayed:
Account Name, Display Name, Email, User Name, Password, Profile Name, Server Address, Server Type, Server Port, and the Registry key where the account information is stored.
You can extract the Outlook accounts information from your local system, from external hard drive, and from remote computer on your network (Requires full admin access).
In order to view the passwords from external drive or remote computer, you must specify the login password of the user who created the accounts.
RuntimeClassesView is a tool for Windows 10 that displays the details of all Windows Runtime classes stored in the Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId.
For every Windows Runtime class, the following information is displayed: Class Name, Filename, Threading, Trust Level, Server, Activation Type, Registry Key, Registry Key Modified Time, Bitness,
version information of the DLL file (File Version, File Company, File Description, File Product Name).
You can use the Quick Filter option (Ctrl+Q) to easily search the desired Windows Runtime class.
TraceMenuID scans all running applications that use the standard menu items of Windows and displays the list of all menu items and their ID.
You can use this tool to easily find ID of menu items and then use the ID to execute the menu item using GUIPropView or any other tool that sends WM_COMMAND message.
Be aware that many popular applications don't use the standard menu system of Windows and thus this tool won't detect them.
Also, some menu items are detected only at the moment you click the menu bar and the menu is displayed on the screen.
ExtPassword! is a powerful tool that extracts passwords and other important data from external hard drive of Windows operating system.
Currently, ExtPassword! supports the following types of passwords:
SMTP/POP3/IMAP/HTTP passwords stored by Microsoft Outlook, Web site passwords stored by Chromium-based Web browsers and Firefox-based Web browsers,
Web site passwords stored by Microsoft Edge, SMTP/POP3/IMAP passwords stored by Thunderbird, Dialup/VPN passwords stored by Windows operating system, Passwords stored in Windows Credentials files,
wireless network keys stored by Windows operating system, security questions of Windows 10, and product keys of Microsoft products.
In order to decrypt all types of passwords, you have to provide the following information: The base path of the external drive (e.g: K:\ ), login passwords of the users (you can type multiple passwords),
Master passwords of Mozilla software (Firefox, Thunderbird).
DocumentTextExtractor is a simple tool that allows you to extract text from documents (html files, MS-Office files, pdf files), using the search handlers installed on your system.
In order to extract the text from document, simply drag the document file from Explorer window into the main window of DocumentTextExtractor, or use the 'Open Document File'
You can also generate a text file from command-line, for example this command extracts the text from 1.docx and saves it into 1.txt:
DocumentTextExtractor.exe /ExtractText c:\temp\1.docx c:\temp\1.txt
Be aware that this tool works only if the right search filter is installed on your system.
In order to extract text from pdf files, you may need to install the PDF iFilter of Adobe.
Download DocumentTextExtractor 32-bit
Download DocumentTextExtractor 64-bit
RegHiveBackup is a simple tool for Windows that allows you to easily backup the Registry files on your system into the specified folder.
Simply specify the backup folder, the Registry hives to backup (HKEY_LOCAL_MACHINE\Software, HKEY_LOCAL_MACHINE\System, HKEY_CURRENT_USER, and others), and then
click the 'Create Registry Backup' button to create the backup.
RegHiveBackup also allows to choose different mode to backup the user Registry hives (ntuser.dat and UsrClass.dat):
You can backup the user Registry hives of the user who runs RegHiveBackup, you can choose to backup the Registry hive of another user, or
you can choose to backup the Registry hives of all users on your system.
RegHiveBackup works on any version of Windows - from Windows XP and up to Windows 10.
Both 32-bit and 64-bit systems are supported.
This tool reads the superfetch files of Windows (AgGlGlobalHistory.db, AgGlFaultHistory.db, AgGlFgAppHistory.db, and others)
and displays the list of files stored in their records. You can choose to view the list of all files, or only files that don't exist on the disk anymore (deleted files).
You can use this tool to read the superfetch files of your current running system or from external disk plugged to your computer.
SuperfetchView also allows you to read a superfetch file from command line and then export the records list to a file, for example:
SuperfetchView.exe /SuperfetchFile "c:\temp\AgGlGlobalHistory.db" /scomma "c:\temp\AgGlGlobalHistory.csv"
BootPerformanceView is a tool for Windows 10/8/7/Vista that displays the performance information of the boot process on your system.
The information is taken from the Microsoft-Windows-Diagnostics-Performance/Operational event log.
For every boot performance record, the following information is displayed:
Boot Start Time, Boot End Time, Boot Time, Main Path Boot Time, Kernel Init Time, Driver Init Time, Devices Init Time, Smss Init Time, User Profile Processing Time, and more...
You can view the boot performance information on your local system, on remote computer on your network, or load it from external event log file.
ShutdownPerformanceView is a tool for Windows that displays the performance information of Windows shutdown process.
The information is taken from the Microsoft-Windows-Diagnostics-Performance/Operational event log.
For every Windows shutdown performance record, the following information is displayed: Shutdown Start Time, Shutdown End Time, Shutdown Time, User Session Time, User Profiles Time, Services Time, and more...
You can view the shutdown performance information on your local system, on remote computer on your network, or load it from external event log file.
The IPNeighborsView tool displays the IP neighbor table of your local computer.
For every IP neighbor entry, the following information is displayed: IP Address, MAC Address, MAC Address Company, State, State Time, Local Adapter Name, Local Connection Name
This tool works on Windows Vista and later.
This tool displays the list of all event log providers on your system.
For every event log provider, the following information is displayed:
Provider Name, Message File 1, Message File 2, Resource File, Parameter File, Help Link, Company, Product Name, File Description, File Version
Every time that you change the login password on your system, Windows stores the hashes of the previous password in the CREDHIST file (Located in %appdata%\Microsoft\Protect\CREDHIST )
This tool allows you to decrypt the CREDHIST file and view the SHA1 and NTLM hashes of all previous passwords you used on your system.
In order to decrypt the file, you have to provide your latest login password.
You can use this tool to decrypt the CREDHIST file on your currently running system, as well as to decrypt the CREDHIST file stored on external hard drive plugged to your computer.
PasswordHashesView is a tool for Windows that displays the SHA1 hash and the NTLM hash of the login password, for users currently logged into your system.
This tool works on any version of Windows, starting from Windows XP and up to Windows 10.
On Windows 64-bit , you must use the 64-bit version of PasswordHashesView.
Download PasswordHashesView 32-bit
Download PasswordHashesView 64-bit
LostMyPassword is a tool for Windows that allows you to recover a lost password, if it's stored by a software installed on your system.
LostMyPassword can extract the passwords from popular programs, including Web browsers (Chrome, Firefox, Microsoft Edge, Internet Explorer, Opera, and more...),
POP3/IMAP/SMTP passwords stored by email software (Microsoft Outlook, Thunderbird, Windows Mail), Dialup/VPN passwords stored by Windows operating system,
login passwords of remote computer stored by Windows operating system.
You can use the LostMyPassword tool in 2 modes: as normal user, and as Administrator. The Administrator mode is needed for some types of passwords because
they cannot be decrypted without Administrator privileges.
If you have 64-bit system, you should use the 64-bit version of LostMyPassword to ensure that you get all passwords stored on your system.
Download LostMyPassword 32-bit
Download LostMyPassword 64-bit