04 · Evidence of Execution
SRUM Forensics: App Usage and Network Bytes per Hour
Use SRUM (SRUDB.dat) to prove which apps ran, under which user, and how many bytes they sent: tables, ID mapping, dirty database repair, SrumECmd, pitfalls.
Guides
09 · USB & External Devices
USB Device Forensics: Tracing Drives, Users and Files
Identify every USB drive connected to a Windows host, date its connections, tie it to a user and prove which files were opened from it, step by step.
06 · User Activity
User Activity Forensics: ShellBags, LNK Files and Jump Lists
Prove which files and folders a Windows user opened, and when: ShellBags, LNK files, Jump Lists, MRU keys, Office Trust Records and Timeline, correlated.
06 · User Activity
Browser Forensics on Windows: Chrome, Edge and Firefox
Investigate Chrome, Edge and Firefox on Windows: History, downloads, cookies, sessions, extensions, WebKit and PRTime timestamps, WAL and deleted records.
03 · Event Logs
Windows Event Log Forensics: EVTX, Event IDs and Hunting
A practitioner guide to Windows event logs: EVTX format, key channels, Security and Sysmon event IDs, audit policy, cleared-log recovery and hunting tools.
01 · Acquisition & Triage
Windows Live Response: What to Capture, in Which Order
Windows live response in practice: order of volatility, memory first, processes, network and sessions, trusted tooling, hashing output and your own footprint.
10 · Memory Forensics
Windows Memory Forensics with Volatility 3: Practical Guide
Acquire Windows RAM, use hiberfil and pagefile, and run a Volatility 3 workflow to find injected code, hidden processes and network activity.
02 · Registry
Windows Registry Forensics: Hives, Keys and Workflow
Windows registry forensics in practice: hive files, transaction logs, control sets, LastWrite limits, deleted keys, the keys that matter and RECmd workflows.
06 · User Activity
Windows Search Index Forensics: Windows.edb and Windows.db
Mine the Windows Search index for file paths, dates, content snippets, Outlook mail and deleted-file remnants: Windows.edb, Windows.db, tools and pitfalls.