> For the complete documentation index, see [llms.txt](https://gitbook.seguranca-informatica.pt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.seguranca-informatica.pt/tools-1/file-analysis.md).

# File Analysis

[**peepdf**](https://github.com/jesparza/peepdf) – PDF analyzer.

**oledump** – Windows file analysis \[[1](https://didierstevens.com/files/software/oledump_V0_0_41.zip)] and \[[2](https://blog.didierstevens.com/programs/oledump-py/)].

[**oletools**](http://www.decalage.info/python/oletools) – Suite to analyze OLE and MS Office files.

[**Structured Storage Viewer (SSV)**](https://www.mitec.cz/ssv.html) – This tool allows to completely manage any MS OLE Structured Storage based file.

[**BiffView**](https://www.aldeid.com/wiki/BiffView)**++** – BiffView is a tool for viewing the BIFF structure of a binary Excel sheet.

{% embed url="<https://github.com/sharkdp/binocle>" %}

[**Disk2vhd**](https://learn.microsoft.com/en-us/sysinternals/downloads/disk2vhd): Convert something to VHD to import in VirtualBox (e.g., nvme ssd). For Virtualbox, uncheck the option: "**use vhdx**".

<figure><img src="/files/hQmYWNriSonahvMRs4M4" alt=""><figcaption></figcaption></figure>

For cloning it, select all devices and partitions:

<figure><img src="/files/0cnYVsIt0fllnbLhSyKL" alt=""><figcaption></figcaption></figure>

In VirtualBox, attach a new optical device:

<figure><img src="/files/cG7uKbdiRKRTTWSZRHda" alt=""><figcaption></figcaption></figure>

Execute the **chntpw** with the virtual machine, and set the Administrator password as BLANK.

<figure><img src="/files/gayCtNSQnKoANvOr6NrO" alt=""><figcaption></figcaption></figure>

Option: 1

<figure><img src="/files/GQ0hWb35ntsD1RyoF8gP" alt=""><figcaption></figcaption></figure>

Option: 1

<figure><img src="/files/0mzUCJJusg89rmsx2d7q" alt=""><figcaption></figcaption></figure>

Option: 1

<figure><img src="/files/oghMxoxtG9pYG4JhSWIk" alt=""><figcaption></figcaption></figure>

Option: 1f4

<figure><img src="/files/ygcBgjeTyowSeWGKdpt4" alt=""><figcaption></figcaption></figure>

Option: 1

After that, detach the optical drive, and restart the VM!

Using dd:

<figure><img src="/files/rS7w0bGfxH90m8FdJ1eX" alt=""><figcaption></figcaption></figure>

```
dd if=/dev/sda1 of=/ruta/diskbak.raw
VBoxManage convertfromraw diskbak.raw --format vdi diskbak.vdi
VBoxManage modifyhd --compact diskbak.vdi

https://www.maravento.com/2013/11/clonacion-virtual-incremental.html
```