The following tools are currently in development stage. They don't have their own icons, there is no screenshot, there is no help file, and there are no translations, only a short description is available.
If you choose to download and try to use them, do it with extreme caution, and of course it's at your own risk !!
The zip files are password-protected. The password to extract the files is SoftNirPre987@
Pre-release NirSoft Tools
DNSLookupView is a DNS tracing tool for Windows 10 that allows you to view the details of every DNS query sent through the DNS Client service of Windows.
For every DNS lookup, the following information is displayed: Host Name, Query Type (A, AAAA, and so on), Query Status (Error or succeeded), Query Result, Query Timestamp,
ID and name of the process that requested the DNS lookup.
Be aware that this tool doesn't work on Windows 7 and older systems, because extensive DNS tracing is not supported on these systems.
OutlookAccountsView displays the details of POP3/IMAP/SMTP accounts configured in Microsoft Outlook.
For every account, the following information is displayed:
Account Name, Display Name, Email, User Name, Password, Profile Name, Server Address, Server Type, Server Port, and the Registry key where the account information is stored.
You can extract the Outlook accounts information from your local system, from external hard drive, and from remote computer on your network (Requires full admin access).
In order to view the passwords from external drive or remote computer, you must specify the login password of the user who created the accounts.
RuntimeClassesView is a tool for Windows 10 that displays the details of all Windows Runtime classes stored in the Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId.
For every Windows Runtime class, the following information is displayed: Class Name, Filename, Threading, Trust Level, Server, Activation Type, Registry Key, Registry Key Modified Time, Bitness,
version information of the DLL file (File Version, File Company, File Description, File Product Name).
You can use the Quick Filter option (Ctrl+Q) to easily search the desired Windows Runtime class.
TraceMenuID scans all running applications that use the standard menu items of Windows and displays the list of all menu items and their ID.
You can use this tool to easily find ID of menu items and then use the ID to execute the menu item using GUIPropView or any other tool that sends WM_COMMAND message.
Be aware that many popular applications don't use the standard menu system of Windows and thus this tool won't detect them.
Also, some menu items are detected only at the moment you click the menu bar and the menu is displayed on the screen.
ExtPassword! is a powerful tool that extracts passwords and other important data from external hard drive of Windows operating system.
Currently, ExtPassword! supports the following types of passwords:
SMTP/POP3/IMAP/HTTP passwords stored by Microsoft Outlook, Web site passwords stored by Chromium-based Web browsers and Firefox-based Web browsers,
Web site passwords stored by Microsoft Edge, SMTP/POP3/IMAP passwords stored by Thunderbird, Dialup/VPN passwords stored by Windows operating system, Passwords stored in Windows Credentials files,
wireless network keys stored by Windows operating system, security questions of Windows 10, and product keys of Microsoft products.
In order to decrypt all types of passwords, you have to provide the following information: The base path of the external drive (e.g: K:\ ), login passwords of the users (you can type multiple passwords),
Master passwords of Mozilla software (Firefox, Thunderbird).
DocumentTextExtractor is a simple tool that allows you to extract text from documents (html files, MS-Office files, pdf files), using the search handlers installed on your system.
In order to extract the text from document, simply drag the document file from Explorer window into the main window of DocumentTextExtractor, or use the 'Open Document File'
You can also generate a text file from command-line, for example this command extracts the text from 1.docx and saves it into 1.txt:
DocumentTextExtractor.exe /ExtractText c:\temp\1.docx c:\temp\1.txt
Be aware that this tool works only if the right search filter is installed on your system.
In order to extract text from pdf files, you may need to install the PDF iFilter of Adobe.
Download DocumentTextExtractor 32-bit
Download DocumentTextExtractor 64-bit
RegHiveBackup is a simple tool for Windows that allows you to easily backup the Registry files on your system into the specified folder.
Simply specify the backup folder, the Registry hives to backup (HKEY_LOCAL_MACHINE\Software, HKEY_LOCAL_MACHINE\System, HKEY_CURRENT_USER, and others), and then
click the 'Create Registry Backup' button to create the backup.
RegHiveBackup also allows to choose different mode to backup the user Registry hives (ntuser.dat and UsrClass.dat):
You can backup the user Registry hives of the user who runs RegHiveBackup, you can choose to backup the Registry hive of another user, or
you can choose to backup the Registry hives of all users on your system.
RegHiveBackup works on any version of Windows - from Windows XP and up to Windows 10.
Both 32-bit and 64-bit systems are supported.
This tool reads the superfetch files of Windows (AgGlGlobalHistory.db, AgGlFaultHistory.db, AgGlFgAppHistory.db, and others)
and displays the list of files stored in their records. You can choose to view the list of all files, or only files that don't exist on the disk anymore (deleted files).
You can use this tool to read the superfetch files of your current running system or from external disk plugged to your computer.
SuperfetchView also allows you to read a superfetch file from command line and then export the records list to a file, for example:
SuperfetchView.exe /SuperfetchFile "c:\temp\AgGlGlobalHistory.db" /scomma "c:\temp\AgGlGlobalHistory.csv"
Every time that you change the login password on your system, Windows stores the hashes of the previous password in the CREDHIST file (Located in %appdata%\Microsoft\Protect\CREDHIST )
This tool allows you to decrypt the CREDHIST file and view the SHA1 and NTLM hashes of all previous passwords you used on your system.
In order to decrypt the file, you have to provide your latest login password.
You can use this tool to decrypt the CREDHIST file on your currently running system, as well as to decrypt the CREDHIST file stored on external hard drive plugged to your computer.
LostMyPassword is a tool for Windows that allows you to recover a lost password, if it's stored by a software installed on your system.
LostMyPassword can extract the passwords from popular programs, including Web browsers (Chrome, Firefox, Microsoft Edge, Internet Explorer, Opera, and more...),
POP3/IMAP/SMTP passwords stored by email software (Microsoft Outlook, Thunderbird, Windows Mail), Dialup/VPN passwords stored by Windows operating system,
login passwords of remote computer stored by Windows operating system.
You can use the LostMyPassword tool in 2 modes: as normal user, and as Administrator. The Administrator mode is needed for some types of passwords because
they cannot be decrypted without Administrator privileges.
If you have 64-bit system, you should use the 64-bit version of LostMyPassword to ensure that you get all passwords stored on your system.
Download LostMyPassword 32-bit
Download LostMyPassword 64-bit