NirBlog

The password recovery package page now contains a new package with full install/uninstall support. When you run the installer, it automatically copies all files into the installation folder that you select, and creates a start menu folder with shortcuts to the all installed utilities and help files.
The uninstaller removes all files, including the configuration files (.cfg) of each utility.

You can download the new package from here.

For very long time, I receive reports from people which says that my NK2View utility
doesn’t show all NK2 records stored in the file. some others reported that NK2View fails to add new items into the file.
Until now, I couldn’t figure out exactly what is wrong.
A few days ago, I received a sample .NK2 file that reproduces both of these problems.
I looked into this file, and I found out that one of the records contains a special multi-values binary field that I have never encountered before. NK2view couldn’t parse this kind of field, and thus the parsing process of the rest of the file was failed too.
Also, I found out that this file contained a sequence of “dead” records (old records that Outlook doesn’t use anymore) in the end of the file, and these records caused NK2view to add new records improperly, and thus both Outlook and my NK2View tool failed to read these new records.

After what I found, I made a serious of changes that fixed both of these problems.
If you used NK2View in the past and you had one of the mentioned problems,
you can try to download the new version of NK2View and see if it solves your problems too.

• OutlookAttachView: Fixed bug that caused OutlookAttachView to fail on scanning sub-folders under main Outlook folders.
  Also added ‘Folder Path’ column that displays the full path of the folder (For example: Personal Folders\Inbox\Bug Reports)
• WhoisThisDomain and WhoisCL: Added/Updated the whois servers for .in, .ie, .me, .tel, and co.nl domains.
• AlternateStreamView and ResourcesExtract: Added support for choosing SubFolders depth in scanning.
• Volumouse: Fixed bug – Windows key settings were not saved when you exit from Volumouse.
• WirelessKeyView: Fixed bug – In Vista, if WPA-PSK key contained 32 characters, the key was not displayed in Ascii form.
• SearchMyFiles:
  • Fixed bug: Base folder combo-box limited the number of characters that you could type.
  • Added option to save/load all search option to .cfg file.
  • Added ‘Explorer Copy’ option – Allows you to copy the selected files and then paste them inside a folder of Windows Explorer.
  • Added ‘Open With’ option.
  • Added option to choose the subfolders depth to scan.

If you use Microsoft Outlook regularly, you probably have many attached files scattered in your mailbox. Some of these attachments were sent by you to other people, some of them were sent by others to your inbox.

But what should you do you if you want to easily extract all these attached files and save them into one folder ?
My new OutlookAttachView utility can help you do that. It displays the list of attached files in your Outlook’s mailbox, and allows you to easily select all attachments that you need, and then extract them into a folder that you choose.

For more information about OutlookAttachView, click here.

RegDllView, InstalledCodec, IECacheView: Added ‘Explorer Copy’ option – Allows you to copy the selected files and then paste them into a folder in Explorer.

FileTypesMan: Added support for creating and deleting file extensions.

WirelessKeyView: New and safer method to extract the wireless keys of the local machine: In previous versions, WirelessKeyView injected code into lsass.exe in order to grab the wireless keys from the system. In rare cases, this technique caused a crash inside lsass.exe process. Starting from this version, WirelessKeyView uses a new method that extract the wireless keys without any code injection.

• Volumouse: Added support for Windows key (in separated check-box) when using hot keys instead of wheel mouse.
• NK2View: Added support for backup/restore options. The backup is made in the same folder of the NK2 file, with .BAK extension.
• VideoCacheView: Added support for .SWF files (By default, this option is not enabled, because the cache may contains a lots of .SWF files, most of them are advertising)

Windows XP provides a basic search module (“Search For Files And Folders”) that can be useful in many cases.
However, this search module also has some restrictions and disadvantages:

• When searching a phrase inside a file, Windows search may not scan all file types, depending on your current service pack, settings in the Registry, and so on. (See KB309173)
• When searching by modified/created date of the file, it only allows you to search by whole days range. It means that you cannot, for example, find all files created yesterday between 11:27 and 11:35
• When searching by file size, it only allows you to specify the size in full KB. It means that you cannot make search by file size in accuracy of bytes. For example: you cannot search files with file size between 252 and 527 bytes.
• It doesn’t allow you to search by file attributes (For example: search only hidden and read only files)
• Windows search has an annoying animated puppy that doesn’t do anything useful 🙂

If you feel frustrated from the above Windows search problems,
you are welcomed to try my new SearchMyFiles utility.

SearchMyFiles is an alternative to the standard “Search For Files And Folders” module of Windows. It allows you to easily search files in your system by wildcard, by last modified/created/last accessed time, by file attributes, by file content (text or binary search), and by the file size. SearchMyFiles allows you to make a very accurate search that cannot be done with Windows search. For Example: You can search all files created in the last 10 minutes with size between 500 and 700 bytes.

You can find the download page of SearchMyFiles here.

Each USB device that you plug to your computer has 2 16-bit numbers that identifies the product: Vendor ID (vid) and Product ID (pid).
The Vendor ID represents the company that produce the USB device, while the combination of Vendor ID and Product ID represents a specific product.
Both of these values displayed by USBDeview from the earlier versions, but until now you couldn’t easily use these numbers to find out the company/product name of the USB device.

Stephen J. Gowdy maintains a very large pid/vid list of popular USB devices.
Starting from version 1.35 of USBDeview, you can download his USB devices/vendors file (usb.ids) and put it on the same folder that USBDeview.exe is located. When you do that, USBDeview automatically loads this USB ID’s file and find the vendor and product names according to this file. This information is displayed in 2 new columns added to USBDeview: Vendor Name and Product Name.

For more information and download link, click here

ChromeCacheView, VideoCacheView and MyLastSearch – Added support for Chrome 2.x

SkypeLogView – Added support for Skype 4

AlternateStreamView – Fixed a few bugs discovered by the users of the first release:

• In Windows Vista, NTFS junction point to ‘Application Data’ folder created a recursive scan. In this version, AlternateStreamView automatically skip junction points.
• AlternateStreamView failed to delete streams of read-only files.
• AlternateStreamView allowed to close the main window during scan.

NTFS system has a feature that allows to add multiple streams in addition to the main file stream. When you open or view the file, only the main file stream is visible, while other additional streams are hidden from the user.

Here’s 3 examples of alternate streams usage in Windows operating system:

1. Favorites of Internet Explorer: When You add a Web site link into your ‘Favorites’, a .url file containing the url and description is created. However, if the Web site also have an icon (favicon), the icon is saved as alternate stream for the same url file. The stream name of the icon is :favicon:$DATA
2. Downloaded files of Internet Explorer: When you download and save a file with Internet Explorer, it automatically add a zone information for the saved file. This zone information is used for identifying the file as downloaded file from the Internet. The stream name in this case is :Zone.Identifier:$DATA
3. Summary information of files: When you right-click on a file in Explorer and go to the ‘Summary’ tab, you can add summary information for the file, like title, subject, author, and so on. This summary information is also saved into alternate stream. The stream name in this case is SummaryInformation:$DATA.

In addition to the legitimate usage of alternate streams, this technique may also be used by Viruses/Trojans/Spywares for saving data and hiding it from the user.

AlternateStreamView is a new GUI tool that allows you to easily scan your NTFS drive, and find all hidden alternate streams stored in the file system. After scanning and finding the alternate streams, you can extract these streams into the specified folder, delete unwanted streams, or save the streams list into text/html/csv/xml file.

For more information and download link, click here