Observed arrival · 2026-09-30
A browser-side parser for Windows scheduled-task evidence
A free DFIR tool that compares Windows task XML, TaskCache registry data, and legacy .job files to help investigators spot hidden, missing, or altered tasks.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- DFIR investigators examining Windows scheduled tasks
- Worth noticing
- Its acquisition guide includes commands for PowerShell and KAPE, and instructions for collecting the SOFTWARE hive alongside task files.
Field notes
The workflow expects task files and the SOFTWARE hive together, either as a folder or ZIP, so the tool can compare filesystem artifacts with registry records. Collection guidance includes a PowerShell script, named KAPE targets, and Velociraptor artifacts. The offered sample is described as a fictional intrusion with inert placeholder commands, giving visitors a way to inspect the interface without using real case data.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
●ProPolished or operationally mature
◎NicheUnusually specific use
ƒJavaScriptBrowser-side code central
One card from the complete issue