Pre-release NirSoft Tools

The following tools are currently in development stage. They don't have their own icons, there is no screenshot, there is no help file, and there are no translations, only a short description is available. If you choose to download and try to use them, do it with extreme caution, and of course it's at your own risk !!

The zip files are password-protected. The password to extract the files is SoftNirPre987@

RuntimeClassesView
RuntimeClassesView is a tool for Windows 10 that displays the details of all Windows Runtime classes stored in the Registry under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsRuntime\ActivatableClassId. For every Windows Runtime class, the following information is displayed: Class Name, Filename, Threading, Trust Level, Server, Activation Type, Registry Key, Registry Key Modified Time, Bitness, version information of the DLL file (File Version, File Company, File Description, File Product Name).

You can use the Quick Filter option (Ctrl+Q) to easily search the desired Windows Runtime class.

Download RuntimeClassesView

TraceMenuID
TraceMenuID scans all running applications that use the standard menu items of Windows and displays the list of all menu items and their ID. You can use this tool to easily find ID of menu items and then use the ID to execute the menu item using GUIPropView or any other tool that sends WM_COMMAND message. Be aware that many popular applications don't use the standard menu system of Windows and thus this tool won't detect them.
Also, some menu items are detected only at the moment you click the menu bar and the menu is displayed on the screen.

Download TraceMenuID

DocumentTextExtractor
DocumentTextExtractor is a simple tool that allows you to extract text from documents (html files, MS-Office files, pdf files), using the search handlers installed on your system.
In order to extract the text from document, simply drag the document file from Explorer window into the main window of DocumentTextExtractor, or use the 'Open Document File' option (Ctrl+O).
You can also generate a text file from command-line, for example this command extracts the text from 1.docx and saves it into 1.txt:
DocumentTextExtractor.exe /ExtractText c:\temp\1.docx c:\temp\1.txt

Be aware that this tool works only if the right search filter is installed on your system. In order to extract text from pdf files, you may need to install the PDF iFilter of Adobe.

Download DocumentTextExtractor 32-bit

Download DocumentTextExtractor 64-bit

RegHiveBackup
RegHiveBackup is a simple tool for Windows that allows you to easily backup the Registry files on your system into the specified folder. Simply specify the backup folder, the Registry hives to backup (HKEY_LOCAL_MACHINE\Software, HKEY_LOCAL_MACHINE\System, HKEY_CURRENT_USER, and others), and then click the 'Create Registry Backup' button to create the backup.
RegHiveBackup also allows to choose different mode to backup the user Registry hives (ntuser.dat and UsrClass.dat): You can backup the user Registry hives of the user who runs RegHiveBackup, you can choose to backup the Registry hive of another user, or you can choose to backup the Registry hives of all users on your system.

RegHiveBackup works on any version of Windows - from Windows XP and up to Windows 10. Both 32-bit and 64-bit systems are supported.

Download RegHiveBackup

SuperfetchView
This tool reads the superfetch files of Windows (AgGlGlobalHistory.db, AgGlFaultHistory.db, AgGlFgAppHistory.db, and others) and displays the list of files stored in their records. You can choose to view the list of all files, or only files that don't exist on the disk anymore (deleted files). You can use this tool to read the superfetch files of your current running system or from external disk plugged to your computer.

SuperfetchView also allows you to read a superfetch file from command line and then export the records list to a file, for example:
SuperfetchView.exe /SuperfetchFile "c:\temp\AgGlGlobalHistory.db" /scomma "c:\temp\AgGlGlobalHistory.csv"

Download SuperfetchView

BootPerformanceView
BootPerformanceView is a tool for Windows 10/8/7/Vista that displays the performance information of the boot process on your system. The information is taken from the Microsoft-Windows-Diagnostics-Performance/Operational event log.

For every boot performance record, the following information is displayed: Boot Start Time, Boot End Time, Boot Time, Main Path Boot Time, Kernel Init Time, Driver Init Time, Devices Init Time, Smss Init Time, User Profile Processing Time, and more...
You can view the boot performance information on your local system, on remote computer on your network, or load it from external event log file.

Download BootPerformanceView

ShutdownPerformanceView
ShutdownPerformanceView is a tool for Windows that displays the performance information of Windows shutdown process. The information is taken from the Microsoft-Windows-Diagnostics-Performance/Operational event log.
For every Windows shutdown performance record, the following information is displayed: Shutdown Start Time, Shutdown End Time, Shutdown Time, User Session Time, User Profiles Time, Services Time, and more...
You can view the shutdown performance information on your local system, on remote computer on your network, or load it from external event log file.

Download ShutdownPerformanceView

EventLogProvidersView
This tool displays the list of all event log providers on your system. For every event log provider, the following information is displayed: Provider Name, Message File 1, Message File 2, Resource File, Parameter File, Help Link, Company, Product Name, File Description, File Version

Download EventLogProvidersView

PasswordHashesView
PasswordHashesView is a tool for Windows that displays the SHA1 hash and the NTLM hash of the login password, for users currently logged into your system.
This tool works on any version of Windows, starting from Windows XP and up to Windows 10. On Windows 64-bit , you must use the 64-bit version of PasswordHashesView.

Download PasswordHashesView 32-bit

Download PasswordHashesView 64-bit

LostMyPassword
LostMyPassword is a tool for Windows that allows you to recover a lost password, if it's stored by a software installed on your system. LostMyPassword can extract the passwords from popular programs, including Web browsers (Chrome, Firefox, Microsoft Edge, Internet Explorer, Opera, and more...), POP3/IMAP/SMTP passwords stored by email software (Microsoft Outlook, Thunderbird, Windows Mail), Dialup/VPN passwords stored by Windows operating system, login passwords of remote computer stored by Windows operating system.
You can use the LostMyPassword tool in 2 modes: as normal user, and as Administrator. The Administrator mode is needed for some types of passwords because they cannot be decrypted without Administrator privileges.
If you have 64-bit system, you should use the 64-bit version of LostMyPassword to ensure that you get all passwords stored on your system.

Download LostMyPassword 32-bit

Download LostMyPassword 64-bit