ThinkDFIR

I was poking around my system recently and noticed something that’s slightly different with the Amcache folder It looks like C:\windows\appcompat\programs now has a few more files than before!

I was recently teaching the SANS FOR500 Windows Forensic Analysis class in Canberra and I was asked a question about how we track the connection times for USB devices in the registry: My answer at the time was, “they are arbitrary” but I thought I should…

During an engagement at $lastdayjob we found a possible bug in AmCache so I wanted to dig into it a bit deeper.

Earlier this year I came across a forensic artefact that I didn’t know a whole lot about, and there wasn’t a lot of research on either.

As part of some research I’m doing into Amcache (more on that another time), I went about exploring Windows PE version information and how Windows see’s it.

A while ago I wrote about how Windows would track screenshots in shell items and cache the content into a specific directory.

This week’s Sunday Funday challenge involves reviewing Microsoft 365 UALs so I figured what better excuse to get access to a dev tenancy.

This week’s Sunday Funday challenge by David Cowen is on SRUM forensics.

Recently one of my fellow SANS instructors, Mattia Epifani, noted that in Windows 11 23H2 the WordWheelQuery value is no longer populated.

There’s a new (newish?)