Difference between revisions of "Libmsiecf"

From ForensicsWiki
Jump to: navigation, search
Line 5: Line 5:
   genre = {{Analysis}} |
   genre = {{Analysis}} |
   license = {{LGPL}} |
   license = {{LGPL}} |
   website = [http://code.google.com/p/libmsiecf/ code.google.com/p/libmsiecf/] |
   website = [https://github.com/libyal/libmsiecf/ github.com/libyal/libmsiecf/] |
Line 41: Line 41:
== External Links ==
== External Links ==
* [http://code.google.com/p/libmsiecf/ Project site]
* [https://github.com/libyal/libmsiecf/ Project site]
* [http://libmsiecf.sourceforge.net/ Old project site]

Revision as of 07:53, 19 October 2014

Maintainer: Joachim Metz
OS: Linux, FreeBSD, NetBSD, OpenBSD, Mac OS X, Windows
Genre: Analysis
License: LGPL
Website: github.com/libyal/libmsiecf/

The libmsiecf package contains a library and applications to read the MSIE Cache File format.


The libmsiecf package contains the following tools:

  • msiecfexport, which exports the items stored in MSIECF files.
  • msiecfinfo, which shows the information about MSIECF files.


Exporting items from an index.dat:

msiecfexport -m items index.dat

Exporting recovered items from an index.dat:

msiecfexport -m recovered index.dat

Exporting an index.dat from a Chinese Windows installation:

msiecfexport -c windows-936 index.dat


Libmsiecf was created by Joachim Metz in 2009, while working for Hoffmann Investigations.

Libmsiecf is a rewrite of pasco with support for more recent versions of MSIE Cache Files

See Also

External Links