Sysinternals
跳到导航
跳到搜索
介绍
Sysinternals 原为 Winternals 公司提供的免费工具，Winternals 公司原本主力研发系统复原与资料保护，为了解决工程师平常在工作上遇到的各种问题，便开发出许多小工具，之后他们将这些工具集合起来称为Sysinternals。
Sysinternals Suite 是微软发布的一套非常强大的免费工具程序集，一共包括 72 个 windows 工具。
工具
| 工具 | 版本 | 说明 |
|---|---|---|
| AccessChk | v6.20 (November 19, 2017) | AccessChk is a command-line tool for viewing the effective permissions on files, registry keys, services, processes, kernel objects, and more.
为了确保创建安全的环境，Windows 管理员通常需要了解特定用户或用户组对文件、目录、注册表项和 Windows 服务等资源具有哪种访问权限。AccessChk 能够通过直观的界面和输出快速回答这些问题。 |
| AccessEnum | v1.32 (November 1, 2006) | This simple yet powerful security tool shows you who has what access to directories, files and Registry keys on your systems. Use it to find holes in your permissions.
这一简单但强大的安全工具可以向您显示，谁可以用何种访问权限访问您系统中的目录、文件和注册表项。使用此工具可查找权限漏洞。 |
| AdExplorer | v1.44 (November 15, 2012) | Active Directory Explorer is an advanced Active Directory (AD) viewer and editor.
这一简单但强大的安全工具可以向您显示，谁可以用何种访问权限访问您系统中的目录、文件和注册表项。使用此工具可查找权限漏洞。 |
| AdInsight | v1.2 (October 26, 2015) | An LDAP (Light-weight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications.
一种 LDAP（轻型目录访问协议）实时监视工具，旨在对 Active Directory 客户端应用程序进行故障排除。 |
| AdRestore | v1.1 (November 1, 2006) | Undelete Server 2003 Active Directory objects.
恢复已删除的 Server 2003 Active Directory 对象。 |
| Autologon | v3.10 (August 29, 2016) | Bypass password screen during logon.
登录过程中跳过密码屏幕。 |
| Autoruns | v13.95 (June 11, 2019) | See what programs are configured to startup automatically when your system boots and you login. Autoruns also shows you the full list of Registry and file locations where applications can configure auto-start settings.
查看哪些程序被配置为在系统启动和您登录时自动启动。Autoruns 还能够完整列出应用程序可以配置自动启动设置的注册表和文件位置。 |
| BgInfo | v4.26 (October 19, 2018) | This fully-configurable program automatically generates desktop backgrounds that include important information about the system including IP addresses, computer name, network adapters, and more.
此完全可配置程序会自动生成桌面背景，其中包含有关系统的 IP 地址、计算机名称、网络适配器及更多内容的重要信息。 |
| BlueScreen | v3.2 (November 1, 2006) | This screen saver not only accurately simulates Blue Screens, but simulated reboots as well (complete with CHKDSK), and works on Windows NT 4, Windows 2000, Windows XP, Server 2003 and Windows 95 and 98.
此屏幕保护程序不仅精确模拟“蓝屏”，而且也模拟重新启动（完成 CHKDSK），并可在 Windows NT 4、Windows 2000、Windows XP、Server 2003 和 Windows 9x 上工作。 |
| CacheSet | v1.0 (November 1, 2006) | CacheSet is a program that allows you to control the Cache Manager's working set size using functions provided by NT. It's compatible with all versions of NT.
CacheSet 是一个允许您利用 NT 提供的功能来控制缓存管理器的工作集大小的程序。它与 NT 的所有版本都兼容。 |
| ClockRes | v2.1 (July 4, 2016) | View the resolution of the system clock, which is also the maximum timer resolution.
查看系统时钟的分辨率，亦即计时器最大分辨率。 |
| Contig | v1.8 (July 4, 2016) | Wish you could quickly defragment your frequently used files? Use Contig to optimize individual files, or to create new files that are contiguous.
您是否希望迅速对您频繁使用的文件进行碎片整理？使用 Contig 优化单个的文件，或者创建连续的新文件。 |
| Coreinfo | v3.31 (August 18, 2014) | Coreinfo is a new command-line utility that shows you the mapping between logical processors and the physical processor, NUMA node, and socket on which they reside, as well as the cache’s assigned to each logical processor.
Coreinfo 是一个新的命令行实用工具，可向您显示逻辑处理器与物理处理器之间的映射、NUMA 节点和它们所处的插槽，以及分配给每个逻辑处理器的缓存。 |
| Ctrl2cap | v2.0 (November 1, 2006) | This is a kernel-mode driver that demonstrates keyboard input filtering just above the keyboard class driver in order to turn caps-locks into control keys. Filtering at this level allows conversion and hiding of keys before NT even "sees" them. Ctrl2cap also shows how to use NtDisplayString() to print messages to the initialization blue-screen.
这是一个内核模式的驱动程序，可在键盘类驱动程序上演示键盘输入过滤，以便将 Caps-Lock 转变为控制键。在此级别过滤允许在 NT 刚好要“看到”键之前变换和隐藏键。Ctrl2cap 还显示如何使用 NtDisplayString() 打印初始化蓝屏的消息。 |
| DebugView | v4.81 (December 4, 2012) | Another first from Sysinternals: This program intercepts calls made to DbgPrint by device drivers and OutputDebugString made by Win32 programs. It allows for viewing and recording of debug session output on your local machine or across the Internet without an active debugger.
Sysinternals 的另一个优先程序：此程序截取设备驱动程序对 DbgPrint 的调用和 Win32 程序生成的 OutputDebugString。它允许在不使用活动的调试器的情况下，在本地计算机上或通过 Internet 查看和记录调试会话输出。 |
| Desktops | v2.0 (October 17, 2012) | This new utility enables you to create up to four virtual desktops and to use a tray interface or hotkeys to preview what’s on each desktop and easily switch between them.
使用这一新的实用工具可以创建最多四个虚拟桌面，使用任务栏界面或热键预览每个桌面上的内容并在这些桌面之间轻松地进行切换。 |
| Disk2vhd | v2.01 (January 21, 2014) | Disk2vhd simplifies the migration of physical systems into virtual machines (p2v.md).
Disk2vhd 可简化从物理系统到虚拟机 (p2v) 的迁移。 |
| DiskExt | v1.2 (July 4, 2016) | Display volume disk-mappings.
显示卷磁盘映射。 |
| Diskmon | v2.01 (November 1, 2006) | This utility captures all hard disk activity or acts like a software disk activity light in your system tray.
此实用工具会捕捉所有硬盘活动，或者在您的系统任务栏中象软件磁盘活动灯一样工作。 |
| DiskView | v2.4 (March 25, 2010.md) | Graphical disk sector utility.
图形磁盘扇区实用工具。 |
| Disk Usage (DU.md)Disk Usage (DU.md) | v1.61 (February 13, 2018) | View disk usage by directory.
按目录查看磁盘使用情况。 |
| EFSDump | v1.02 (November 1, 2006) | View information for encrypted files.
查看加密文件的信息。 |
| FindLinks | v1.1 (July 4, 2016) | FindLinks reports the file index and any hard links (alternate file paths on the same volume.md) that exist for the specified file. A file's data remains allocated so long as at it has at least one file name referencing it. |
| Handle | v4.11 (December 12, 2017) | This handy command-line utility will show you what files are open by which processes, and much more.
此易用命令行实用工具将显示哪些进程打开了哪些文件，以及更多其他信息。 |
| Hex2dec | v1.1 (July 4, 2016) | Convert hex numbers to decimal and vice versa.
将十六进制数字转换为十进制及反向转换。 |
| Junction | v1.07 (July 4, 2016) | Create Win2K NTFS symbolic links.
创建 Win2K NTFS 符号链接。 |
| LDMDump | v1.02 (November 1, 2006) | Dump the contents of the Logical Disk Manager's on-disk database, which describes the partitioning of Windows 2000 Dynamic disks.
转储逻辑磁盘管理器在磁盘上的数据库内容，其中说明了 Windows 2000 动态磁盘的分区情况。 |
| ListDLLs | v3.2 (July 4, 2016) | List all the DLLs that are currently loaded, including where they are loaded and their version numbers.
列出所有当前加载的 DLL，包括加载位置及其版本号。2.0 版将打印已加载模块的完整路径名。 |
| LiveKd | v5.62 (May 16, 2017) | Use Microsoft kernel debuggers to examine a live system.
使用 Microsoft 内核调试程序检查真实系统。 |
| LoadOrder | v1.01 (July 4, 2016) | See the order in which devices are loaded on your WinNT/2K system.
查看设备加载到 WinNT/2K 系统中的顺序。 |
| LogonSessions | v1.4 (July 4, 2016) | List the active logon sessions on a system.
列出系统中的活动登录会话。 |
| MoveFile | v1.01 (January 24, 2013) | Allows you to schedule move and delete commands for the next reboot.
使您可以安排在系统下一次重新启动时执行移动和删除命令。 |
| NotMyFault | v4.01 (November 18, 2016) | Notmyfault is a tool that you can use to crash, hang, and cause kernel memory leaks on your Windows system. |
| NTFSInfo | v1.2 (July 4, 2016) | Use NTFSInfo to see detailed information about NTFS volumes, including the size and location of the Master File Table (MFT) and MFT-zone, as well as the sizes of the NTFS meta-data files.
用 NTFSInfo 可以查看有关 NTFS 卷的详细信息，包括主文件表 (MFT) 和 MFT 区的大小和位置，以及 NTFS 元数据文件的大小。 |
| PendMoves | v1.2 (February 5, 2013) | Enumerate the list of file rename and delete commands that will be executed the next boot.
枚举在系统下一次启动时所要执行的文件重命名和删除命令的列表。 |
| PipeList | v1.02 (July 4, 2016) | Displays the named pipes on your system, including the number of maximum instances and active instances for each pipe.
显示系统上的命名管道，包括每个管道的最大实例数和活动实例数。 |
| PortMon | v3.03 (January 12, 2012) | Monitor serial and parallel port activity with this advanced monitoring tool. It knows about all standard serial and parallel IOCTLs and even shows you a portion of the data being sent and received. Version 3.x has powerful new UI enhancements and advanced filtering capabilities.
通过高级监视工具监视串行端口和并行端口的活动。它能识别所有的标准串行和并行 IOCTL，甚至可以显示部分正在发送和接收的数据。3.x 版具有强大的新 UI 增强功能和高级筛选功能。 |
| ProcDump | v9.0 (May 16, 2017) | This command-line utility is aimed at capturing process dumps of otherwise difficult to isolate and reproduce CPU spikes. It also serves as a general process dump creation utility and can also monitor and generate process dumps when a process has a hung window or unhandled exception.
这一新的命令行实用工具旨在捕获其他方式难以隔离和重现 CPU 峰值的进程转储。该工具还可用作用于创建进程转储的一般实用工具，并可以在进程具有挂起的窗口或未处理的异常时监视和生成进程转储。 |
| Process Explorer | v16.21 (May 16, 2017) | Find out what files, registry keys and other objects processes have open, which DLLs they have loaded, and more. This uniquely powerful utility will even show you who owns each process.
找出进程打开了哪些文件、注册表项和其他对象以及已加载哪些 DLL 等信息。这个功能异常强大的实用工具甚至可以显示每个进程的所有者。 |
| Process Monitor | v3.50 (February 13, 2018) | Monitor file system, Registry, process, thread and DLL activity in real-time.
实时监视文件系统、注册表、进程、线程和 DLL 活动。 |
| PsExec | v2.2 (June 29, 2016) | Execute processes on remote systems.
在远程系统上执行进程。 |
| PsFile | v1.03 (June 29, 2016) | See what files are opened remotely.
查看远程打开的文件。 |
| PsGetSid | v1.45 (June 29, 2016) | Displays the SID of a computer or a user.
显示计算机或用户的 SID。 |
| PsInfo | v1.78 (June 29, 2016) | Obtain information about a system.
获取有关系统的信息。 |
| PsKill | v1.16 (June 29, 2016) | Terminate local or remote processes.
终止本地或远程进程。 |
| PsPing | v2.01 (January 29, 2014) | Measure network performance. |
| PsList | v1.4 (June 29, 2016) | Show information about processes and threads.
显示有关进程和线程的信息。 |
| PsLoggedOn | v1.35 (June 29, 2016) | Show users logged on to a system.
显示登录到某个系统的用户。 |
| PsLogList | v2.8 (June 29, 2016) | Dump event log records.
转储事件日志记录。 |
| PsPasswd | v1.24 (June 29, 2016) | Changes account passwords.
更改帐户密码。 |
| PsService | v2.25 (June 29, 2016) | View and control services.
查看和控制服务。 |
| PsShutdown | v2.52 (December 4, 2006) | Shuts down and optionally reboots a computer.
关闭并重新启动（可选）计算机。 |
| PsSuspend | v1.07 (June 29, 2016) | Suspend and resume processes.
挂起和继续进程。 |
| PsTools | v2.45 (July 4, 2016) | The PsTools suite includes command-line utilities for listing the processes running on local or remote computers, running processes remotely, rebooting computers, dumping event logs, and more.
PsTools 套件包括一些命令行程序，可列出本地或远程计算机上运行的进程、远程运行进程、重新启动计算机、转储事件日志，以及执行其他任务。 |
| RAMMap | v1.51 (May 31, 2018) | An advanced physical memory usage analysis utility that presents usage information in different ways on its several different tabs. |
| RegDelNull | v1.11 (July 4, 2016) | Scan for and delete Registry keys that contain embedded null-characters that are otherwise undeleteable by standard Registry-editing tools.
扫描并删除包含嵌入空字符的注册表项，标准注册表编辑工具不能删除这种注册表项。 |
| Registry Usage (RU.md) | v1.2 (July 4, 2016) | View the registry space usage for the specified registry key. |
| RegJump | v1.1 (April 20, 2015) | Jump to the registry path you specify in Regedit.
跳至 Regedit 中指定的注册表路径。 |
| SDelete | v2.01 (February 13, 2018) | Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program.
安全地覆盖敏感文件，并使用此符合 DoD 的安全删除程序清理先前删除文件所在的可用空间。 |
| ShareEnum | v1.6 (November 1, 2006) | Scan file shares on your network and view their security settings to close security holes.
扫描网络上的文件共享并查看其安全设置，以关闭安全漏洞。 |
| ShellRunas | v1.01 (February 28, 2008) | Launch programs as a different user via a convenient shell context-menu entry.
通过方便的 shell 上下文菜单项，作为另一个用户启动程序。 |
| Sigcheck | v2.70 (October 19, 2018) | Dump file version information and verify that images on your system are digitally signed.
转储文件版本信息并检查系统中的映像是否已进行数字签名。 |
| Streams | v1.6 (July 4, 2016) | Reveal NTFS alternate streams.
显示 NTFS 备用数据流。 |
| Strings | v2.52 (June 20, 2013) | Search for ANSI and UNICODE strings in binary images.
在二进制映像中搜索 ANSI 和 UNICODE 字符串。 |
| Sync | v2.2 (July 4, 2016) | Flush cached data to disk.
将缓存数据刷新到磁盘。 |
| Sysmon | v10.0 (June 11, 2019) | Monitors and reports key system activity via the Windows event log.
将缓存数据刷新到磁盘。 |
| TCPView | v3.05 (July 25, 2011) | Active socket command-line viewer.
活动套接字命令行查看器。 |
| VMMap | v3.26 (June 11, 2019) | VMMap is a process virtual and physical memory analysis utility.
VMMap 是进程虚拟和物理内存分析实用工具。 |
| VolumeId | v2.1 (July 4, 2016) | Set Volume ID of FAT or NTFS drives.
设置 FAT 或 NTFS 驱动器的卷 ID。 |
| Whois | v1.20 (November 19, 2017) | See who owns an Internet address.
查看 Internet 地址的所有者。 |
| WinObj | v2.22 (February 14, 2011) | The ultimate Object Manager namespace viewer is here.
基本对象管理器命名空间查看器。 |
| ZoomIt | v4.5 (June 20, 2013) | Presentation utility for zooming and drawing on the screen.
在屏幕上进行缩放和绘图的演示实用工具。 |
SDelete
SDelete 用来安全的、不可恢复的删除文件，以及多次擦除剩余空间。 由于原理比较复杂，简单说明其操作过程，即“在文件内容区域先全部写入0，再写入1，最后删除”。另外，SDelete 还考虑了压缩文件和EFS的情况。
SDelete 带有许多选项的命令行实用工具：
D:/SysinternalsSuite>sdelete /? SDelete - Secure Delete v1.51 Copyright (C) 1999-2005 Mark Russinovich Sysinternals - www.sysinternals.com usage: sdelete [-p passes] [-s] [-q] <file or directory> sdelete [-p passes] [-z|-c] [drive letter] -c Zero free space (good for virtual disk optimization) -p passes Specifies number of overwrite passes (default is 1) -q Don't print errors (Quiet) -s Recurse subdirectories -z Clean free space
- 按照相应的操作步骤，它可以删除一个或多个文件或者目录，或者清理逻辑磁盘上的可用空间。
- SDelete将通配符接受为目录或文件说明符的一部分。
- SDelete删除文件，会对磁盘进行覆写，所以文件不能被恢复。
使用
有几种使用方式：
- 命令提示符：
- 将路径“D:\Program Files\SysinternalsSuite\SDelete”添加到系统环境变量，则可以在其他路径直接使用“sdelete”命令。
- 对于文件与文件夹：
# 直接删除 demo.txt 文件 sdelete demo.txt # 直接删除 demo.txt 文件，并且进行 5 次覆盖 sdelete -p 5 demo.txt # 删除 c:\folders 以及子文件夹 sdelete -s c:\folders
- 对于剩余空间：
# 安全的清除 C 盘剩余空间，不影响已有文件 sdelete -c c: # 安全的清除 5 次 C 盘剩余空间 sdelete -c -p 5 c: # 对 C 盘剩余空间写零，适合虚拟磁盘优化 sdelete -z c:
- 根据操作系统 32、64 位不同，命令为 sdelete64、sdelete。
- 通过注册表：
- 下载后存到“Windows/System32/”目录中，再用如下注册表项加到文件和文件夹的右键菜单中，就可以直接在资源管理器中彻底删除文件。
Windows Registry Editor Version 5.00 [HKEY_CLASSES_ROOT/*/shell/彻底删除/command] @="C://Windows//System32//SDelete.exe -p 1 -q /"%1/"" [HKEY_CLASSES_ROOT/Folder/shell/彻底删除/Command] @="C://Windows//System32//SDelete.exe -p 1 -s -q /"%1/""
- 不好使！还不如用命令行。【2020/09/10 06:21:53】
- 批处理：
- 创建批处理“sdel.bat”（sdelete 位于“D:/SysinternalsSuite/”）：
@echo off echo 注意！彻底删除! ①取消？请按Ctrl+c ②确认？请按任意键 pause >nul "D:/SysinternalsSuite/sdelete.exe" -p 2 -s %1 echo 结果如上，按任意键退出 pause >nul
- 把“sdel.bat”放到桌面上，以后把要粉碎的文件拖过来即可。
- 把“sdel.bat”放到“C:/Documents and Settings/用户名/SendTo”，就可以在资源管理器中直接右键粉碎。