AdExplorer - Active Directory viewer and editor.AccessEnum - Full view of your file system and registry security settings.AccessChk - Lets you see what type of access users and groups have to files, directories, registry keys, etc.Here is a list of the tools (in alphabetical order) and their function. Once you have install it, you can look in the SysinternalsSuite folder and see the numerous tools available.

Step 1: Install SysinternalsĪs I mentioned earlier, Microsoft provides Windows Sysinternals for free, and you can download it here.

Windows Sysinternals is particularly useful when we suspect a system has been hacked and we are trying to understand what processes the malware is using and how it is operating. For the hacker who can get physical access to a system or upload these tools to a system, it can provide invaluable information on the potential target. They can be excellent for doing onsite forensics of a live system or incident response analysis of a system you suspect has been hacked. These are some of the best tools for in-depth analysis of a system. Originally, they were all command line tools, but since Microsoft purchased them they have put some pretty GUIs on many of the tools. These tools proved so effective that Microsoft purchased them in 1996 and continues to provide them free of charge. In this tutorial, we will use another tool that can be used in either discipline-Sysinternals-a suite of tools developed by Mark Russinovich. In many cases, both disciplines will use the same tool.

Both disciplines, hacking and forensics, benefit from a knowledge of the other.

In many of my earlier tutorials, I mentioned the complementary nature of hacking and forensics.

How to use sysinternals suite