Forensicswiki.org has moved to this site, forensicswiki.xyz. For information, please join the Google Group forensicswiki-reborn
Libmsiecf
Jump to navigation
Jump to search
| libmsiecf | |
|---|---|
| Maintainer: | Joachim Metz |
| OS: | Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows |
| Genre: | Analysis |
| License: | LGPL |
| Website: | github.com/libyal/libmsiecf/ |
The libmsiecf package contains a library and applications to read the MSIE Cache File format.
Tools
The libmsiecf package contains the following tools:
- msiecfexport, which exports the items stored in MSIECF files.
- msiecfinfo, which shows the information about MSIECF files.
Examples
Exporting items from an index.dat:
msiecfexport -m items index.dat
Exporting recovered items from an index.dat:
msiecfexport -m recovered index.dat
Exporting an index.dat from a Chinese Windows installation:
msiecfexport -c windows-936 index.dat
History
Libmsiecf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.
Libmsiecf is a rewrite of pasco with support for more recent versions of MSIE Cache Files