In early versions of GetRight there was a little traffic display in the lower right corner. I converted this display into a separate application. The small windows can be moved freely on the desktop and is always shown in foreground. This version of the program only supports dial-up adapters (modem, ISDN).

This application monitors every network traffic and shows it in the same manner as DuamonXP. Ethermon uses the funktion GetIfTable from iphlpapi.dll.

Using Hash you can show and compare the hash values MD5, CRC32 and SHA-1, SHA-224, SHA-256, SHA-384 and SHA-256 for any file.

JumpReg can be used to "jump to" a given registry entry, for instance copied from a web site, in Regedit. Similarily as it does Registry Monitor from  www.sysinternals.com.

My first .NET-2.0 program. It uses WMI functions to show the temperature for the first connected hard drive in the tray area and a chart. S.M.A.R.T. values can be displayed alongside.

Abbreviation for McAfee Exclusion List Editor. There is a built-in option in VirusScan 9.0 and 10.0 to exclude several files and directories from being scanned by the on-access scanner. But there is no GUI from McAfee. My program closes this gap.

The Sudoku wave gripped germany in 2005 too. Instead of solving the many puzzles with the troublesome pen algorithm I had more fun in writing a programmatical solution aid. Thus the Sudoku phenomenon was history for me.

Reading the book "Windows Internals" by Mark Russinovich and David Solomon inspired me, to explore the virtual address space of user processes using the VirtualQueryEx function. WinEnumPS lists all processes and the DLLs and memory mapped files mapped into their address space. You can display the maximum available virtual memory for a process (for instance DLLs that have their preferred base address at 10000000h, are responsible for the fact that only 1200 MB contiguous memory can be allocated by VirtualAlloc in Delphi). The memory allocation can be shown as a graphic. Additionally every memory range of all processes can be viewed in detail. The SeDebugPrivilege is requested to accomplish that.

With TXT Event Log Viewer you can view event log files in TXT or CSV format. The file formats of a direct export from eventvwr.exe or created by MPSReports tools are supported (dumpel.exe). Needs .NET Framework 2.0.

WhoIsIt serves the purpose to learn names of persons. In the program directory of whoisit.exe there has to be a file named list.txt with the names and picture files in the following structure: "name;file_name_including_path". A status file is saved in the AppData directory of the user.

Using this program a directory structure can be searched for executable files. Internal information and flags are listed for every found application and DLL.

Allows access to the content, cookies and history entries of the index.dat. The cache entries can be deleted indvidually or alltogeter. The functions FindFirstUrlCacheEntry and FindNextUrlCacheEntry as well as DeleteUrlCacheEntry from wininet.dll are used.

Creates a random password of configuarable length.

Works similarly like Diskview from www.sysinternals.com with the difference, that the exact position of system files (like $MFT or $Secure and so on) and their attributes on NTFS volumes is displayed as well. The application uses the DeviceIoControl functions FSCTL_GET_NTFS_VOLUME_DATA, FSCTL_GET_NTFS_FILE_RECORD and FSCTL_GET_VOLUME_BITMAP. I recommend the free defragmenter JKDefrag to clean up the mess.

There is no option in Internet Explorer 7.0 to create a duplicate of the currently open tab. That's why I wrote a browser extension that implements an additional menu entry under "Tools" . To install the extension copy the file clonetab.exe from the archive into the directory "C:\program files\Internet Explorer\Exec". After that the extension as to be registered by executing the _install_en.reg. The following entries are made:

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Extensions\{1D32B349-02E3-47c4-8A17-59FE88810590}]
"CLSID"="{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"
"MenuCustomize"="tools"
"MenuText"="Clone tab"
"MenuStatusBar"="Duplicates the current tab"
"Exec"="C:\\program files\\Internet Explorer\\Exec\\clonetab.exe"

Monitors the usage of paging files.

Lists all file and directory objects of a NTFS volume and adds up the file sizes for the directory including all files and subdirectories. Thanks to the direct access to the MFT this operation is very fast. The file sizes listed in the MFT and the actually used clusters for the attributes and streams of a file are shown. The sizes of the hidden NTFS system files are displayed as well. Hint: If files are shown multiple times, this is no bug. NTFS sometimes creates several file entries with a part of the entire amount for one single file.

Creates an index of a complete NTFS drive within a few seconds and allows a full-text search for file names. The search result are immediately shown while the search text is being entered. Usage: NTFSniffer <drive letter:>
A cache file (*.zbin) is stored in the directory "%LOCALAPPDATA%\Alexander Freudenberg\NTFSniffer". "%LOCALAPPDATA%" = "%USERPROFILE%\Local Settings\Application Data" is true for Windows XP.
In the latest version you can switch between the drive on the GUI. A simple RegEx search is implemented. The syntax resembles the LIKE command of SQL. Example: abc[0-3]x[^mn]*.z?? finds all files beginning with abc, then a number between 0 and 3, an x, a character except m and n, any characters, a .z and after that exactly two characters of any kind.
Version of 02/21/2009: In the context menu a file can be copied, moved or a hardlink of it can be created.

Another program based upon my NTFS routines. It can be used to examine changes on the file system. It works on the snapshot principle. A snapshot takes just a few seconds.

It happens occasionally that you are unable to open or save attachments in Outlook. The reason for that is, that the OLK folder, which Outlook is using to store temporary files, contains too many files. With this program you can empty the cache.

Shows the largest files on the selected volume.
Update of 08/09/2009: In a third column the number of fragments is displayed as well. The file can be defragmented from the context menu by using contig.exe from www.sysinternals.com.

Shows all available Windows special folders by means of SHGetSpecialFolderPath (VB 2008).

Lists all loaded drivers and their position in kernel memory. Supplement to driverquery. Can be used to assign blue screen memory positions to a driver (if the drivers are loaded to the same position at every system start)

Shows the  S.M.A.R.T attributes of all attached hard disks. Requires .NET Framework 4.0.
Change of 3/12/2011: Shows vendor specific attributes for the Crucial RealSSD C300 (Micron documentation)

Checks if the partitions of the system are aligned to "round" offsets. This is especially important for SSD disks. Requires .NET Framework 4.0.

My first C# application. It can be used to convert a time_t value into a readable date format. The time stamp of an executable or dll is stored in this format and occasionally shown in connection with EventID 1000 in the event log. The Dependency Walker shows Link Time Stamp in a column. Including source.