NirBlog

ExtPassword! is new tool for Windows that allows you to extract passwords from external disk plugged to your computer.
ExtPassword! can decrypt and extract multiple types of passwords and essential information, including passwords of common email software (Outlook, Thunderbird, Windows Mail App of Windows 11/10), passwords of common Web browsers (Chrome, Firefox, and others), wireless network keys, dialup/VPN passwords, Windows network credentials, Windows product key, Windows security questions.

The ExtPassword! tool might be useful if you have a disk with Windows operating system that cannot boot anymore, and you want to extract your passwords from it.

You can find more information about this tool in this Web page.

WinDefLogView is a new tool for Windows 10 and Windows 11 that reads the event log of Windows Defender (Microsoft-Windows-Windows Defender/Operational) and displays a log of threats detected by Windows Defender on your system.  For every log line, the following information is displayed: Detect Time, Filename, Threat Name, Severity, Category, Detection User, Action, Origin, and more…
WinDefLogView allows you to load the detected threats log from your local system, from one or more remote computers on your network, and from external drive plugged to your computer

You can download the new WinDefLogView tool from this Web page.

The new version of Wireless Network Watcher (v2.30) allows you to add your own menu items to the right-click context menu, by editing the configuration file (WNetWatcher.cfg)
For every custom menu item, you can choose the caption of the menu and the command that will be executed when you click the menu item.
In the command string you can put variables that will be replaced with the data from the selected item, like IP address, device name, MAC address, and so on.

Here’s an example for custom menu you can add to the configuration file of Wireless Network Watcher:

[CustomMenu]
Caption0=Ping IP address
Command0=cmd.exe /K ping %IPAddress%
Caption1=Ping Host Name
Command1=cmd.exe /K ping %DeviceName%
Caption2=Check IP Address With Nbtstat
Command2=cmd.exe /K nbtstat.exe -A %IPAddress%
Caption3=-
Caption4=Open IP Address In Chrome
Command4=chrome.exe %IPAddress%
Caption5=Open IP Address In Firefox
Command5=Firefox.exe %IPAddress%
Caption6=-
Caption7=Open Admin Share
Command7=ShellExecute:\\%IPAddress%\Admin$

After adding the above custom menu to the configuration file, the context menu looks like this:

You can find more information about the custom menu feature in the Web page of  Wireless Network Watcher.

Also, it’s possible that the custom menu feature will be added to other NirSoft tools in the near future.

WinMailPassRec is a new tool for Windows 10 and Windows 11 that displays the details of all Exchange/POP3/IMAP/SMTP accounts stored in the mail application of Windows operating system.
For every account, the following information is displayed: Account Name, Mailbox Type, Email, Mail Server, User Name, Password, Outgoing Server, Outgoing Server Password, Account Creation Time, Last Used Time, Last Sync Attempt Time, Last Sync Success Time.

You can extract the passwords and account information of Windows Mail App from your current user, or from external disk plugged to your computer.
After WinMailPassRec decrypts and extracts your passwords and accounts information, you can easily export them to comma-delimited/Tab-Delimited/HTML/XML/JSON file.

You can download the new WinMailPassRec tool from this Web page.

OutlookAccountsView is a new password recovery tool that extracts and displays the details of all IMAP/POP3/SMTP accounts stored in the profiles of Microsoft Outlook software.
For every account, the following information is displayed: Account Name, Display Name, Email, User, Password, Profile Name, Server Address, Server Type, Server Port, Registry Key, Windows User, and PST files used for this account.

You can extract the Outlook accounts information of the current user, from external hard drive plugged to your computer, and from remote computer on your network.

You can use this tool on any version of Windows, starting from Windows XP and up to Windows 11, with any version of Outlook starting from Outlook 2007 and up to Outlook 2019.

You can download the new OutlookAccountsView tool from this Web page.

Some of the password-recovery tool on NirSoft Web site allows you to decrypt passwords stored on external hard drive plugged to your computer.
If the passwords are encrypted with the DPAPI (Data Protection API) system, you may need to type your login password, because the login password is used
to decrypt the encryption key, and without the login password it’s impossible to recover the passwords instantly.

However, if you login with your Microsoft account (On Windows 10 and Windows 11), the login password is not used anymore.
Instead of the login password, Microsoft generates a random 44-characters password for your Microsoft account, and this password is used in the DPAPI encryption process instead of the login password.

So if you want to recover from external drive the DPAPI passwords created under Microsoft account , you have to provide the random password generated for your Microsoft account instead of the login password.
You can get this random password by using the new MadPassExt tool.

The new MadPassExt tool

The MadPassExt tool decrypts the cache file of your Microsoft account, located under C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\CloudAPCache\MicrosoftAccount ,
and extracts the randomly generated password needed to decrypt DPAPI-encrypted passwords stored on external drive.
This cache file is created when you login into Windows 10 and Windows 11 with your Microsoft account.

In order to decrypt the Microsoft account cache file, you have to provide the actual login password of your Microsoft account.

The new MadPassExt tool is available to download from this Web page.

The new version of the SearchMyFiles tool (v3.15) allows you to easily search empty folders on your system.
In order to search empty folders with the SearchMyFiles tool, follow the instructions below:

1. Click the ‘Reset To Default’ button to ensure that all files are scanned.
2. Type the base folder to search.
3. Choose ‘Summary Mode’ in the Search Mode combo-box, and then in the nearby combo-box choose one of the following options: ‘Only folders with zero files and subfolders’ or ‘Only folders with zero files’. If you choose the first option, only completely empty folders without files or folders will be displayed. If you choose the second option, SearchMyFiles will also display folders with subfolders, as long as the folder and all its subfolders are empty from files.

After the search of empty folders is completed, you can optionally delete these empty folders by using the ‘Delete Selected Empty Folders’ option.
But before you start to use the delete feature, read this warning: Although deleting an empty folder is relatively a safe action, it’s possible that delete of empty folders will cause a significant problem (For example: a software that expects a specific directory structure, and doesn’t work properly without it).
So when you choose to delete empty folders, it’s your responsibility to check every empty folder you want to delete and ensure it’s ok to delete. It’s also recommended to export the empty directories list to a file, so if there is a problem after the empty folders deletion, you’ll be able to create again the deleted empty folders.

SoundVolumeCommandLine (svcl.exe) is a new console application that allows you to do many actions related to sound volume from command-line, including – set sound volume of devices and applications, mute / unmute devices and applications, increase/decrease volume of devices and applications, set the volume level of specific channel, set the default render/capture device, get the current sound volume level of specific device, and more…

svcl.exe is the console version of the SoundVolumeView tool, so you can use all commands of SoundVolumeView in svcl.exe, with exactly the same syntax.

This tool is released because when running .exe with command-line options – a console application has some advantages over a GUI application.
For example: If you want to get the current volume level (e.g: /GetPercent command), the console application is much easier to use then the GUI tool.

You can download the new SoundVolumeCommandLine tool from this Web page.

IPNeighborsView is a new tool that displays the IP neighbor table of your local computer. For every IP neighbor entry, the following information is displayed:  IP Address, MAC Address, MAC Address Company, State, State Time, Local Adapter Name, Local Connection Name.
In the IP neighbor table, you can find the details of computers and devices recently connected to your network. Be aware that devices are listed only if Windows operating system detected them.
This tool works on any version of Windows, starting from Windows Vista and up to Windows 10. Both 32-bit and 64-bit systems are supported.

You can download the new IPNeighborsView tool from this Web page.

The new version of PingInfoView tool allows you to easily specify group name for every group of computers that you want to ping. When group name is specified, every group is displayed separately, and you can collapse and expand a group by double-clicking the group header.

In order to use this feature, you have to turn on the ‘Use IP-Host Description format’ option and then type the IP addresses, names, and groups in the following format:

The result looks like this:

You can download the new version of PingInfoView tool from this Web page.