Windows File Analyzer 95%

Some editions offer capabilities to view recently accessed files, though it is not a full-featured browser forensic tool.

As a portable app, it requires no installation, making it ideal for running from a USB drive on a subject machine.

Parses Picasa’s image management databases. Windows File Analyzer

Establish that a specific user was looking at certain images or files.

Reads thumbnail databases created by the ACDSee image viewer. Some editions offer capabilities to view recently accessed

A full-featured forensic suite for disk image analysis.

An Eric Zimmerman tool for parsing NTFS Master File Table ($MFT) files. it requires no installation

Note: For performance auditing, the , part of the Windows Performance Toolkit, is used instead. db files for evidence?