12 · Timeline Analysis
Building a Super Timeline with Plaso
Build and filter a Windows super timeline with Plaso: log2timeline, psteal and psort flags, time zones, MACB, Timeline Explorer, EZ Tools CSVs and pivoting.
Guides
04 · Evidence of Execution
Evidence of Execution: Prefetch, Amcache, BAM and More
Prove a program ran on Windows, not just existed: Prefetch, ShimCache, Amcache, BAM, UserAssist, SRUM, PCA, WER and 4688 compared, with parsing commands.
01 · Acquisition & Triage
Getting Started with Windows Forensics
Start Windows DFIR the right way: investigative mindset, order of volatility, what to collect, the key evidence areas, free tools and a first-48-hours plan.