Sitemap
All pages on the site.
Home
Guides
- Windows Acquisition and Triage with KAPE and Velociraptor
- Active Directory Forensics: Domain Controller Event Logs
- Credential Access Forensics: LSASS, DCSync and Kerberoasting
- Detecting Windows Anti-Forensics: What Survives the Cleanup
- Hunting Windows Persistence: Registry, Tasks, WMI and More
- Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
- NTFS Forensics: $MFT, USN Journal and $LogFile Explained
- Phishing Forensics: MotW, ISO, LNK and Initial Access
- Remote Access Tool Forensics: AnyDesk, TeamViewer and More
- SRUM Forensics: App Usage and Network Bytes per Hour
- USB Device Forensics: Tracing Drives, Users and Files
- User Activity Forensics: ShellBags, LNK Files and Jump Lists
- Browser Forensics on Windows: Chrome, Edge and Firefox
- Windows Event Log Forensics: EVTX, Event IDs and Hunting
- Windows Live Response: What to Capture, in Which Order
- Windows Memory Forensics with Volatility 3: Practical Guide
- Windows Registry Forensics: Hives, Keys and Workflow
- Windows Search Index Forensics: Windows.edb and Windows.db
- Building a Super Timeline with Plaso
- Evidence of Execution: Prefetch, Amcache, BAM and More
- Getting Started with Windows Forensics