add nirsoft tools and update forensic.bat