04 · Evidence of Execution
SRUM Forensics: App Usage and Network Bytes per Hour
Use SRUM (SRUDB.dat) to prove which apps ran, under which user, and how many bytes they sent: tables, ID mapping, dirty database repair, SrumECmd, pitfalls.
Articles tagged: #execution
04 · Evidence of Execution
Evidence of Execution: Prefetch, Amcache, BAM and More
Prove a program ran on Windows, not just existed: Prefetch, ShimCache, Amcache, BAM, UserAssist, SRUM, PCA, WER and 4688 compared, with parsing commands.