Forensic Artifacts

53 results - showing 41 - 53
1 2 3
28

Artifacts

Operating System
Windows
Windows maintains connection history of wired and wireless network connections. Registry information here: https://www.dfir.training/resources/downloads/windows-registry
43

Artifacts

Operating System
Windows
Tracks files that have been opened or saved within a Windows shell dialog box. ...
81

Artifacts

Operating System
Windows
Prefetch files, like any other file in a file system, can be viewed from a digital forensic perspective to...
28
"Program execution launched on a Win10 system is tracked in the RecentApps key" - https://www.andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/ ...
39

Artifacts

Operating System
Windows
The Windows Recycle Bin contains files that have been deleted by the user, but not yet purged from...
16

Artifacts

Operating System
Windows
"The MRU in MRU lists stands for "Most Recently Used." The MRU list is a Windows-based application that...
13

Artifacts

Operating System
Mac
pstirparo/mac4n6 https://github.com/pstirparo/mac4n6 mac4n6 https://www.mac4n6.com/...
12

Artifacts

Operating System
Mac
Safari cache URL response
148

Artifacts

Operating System
Windows
"The Microsoft Windows 8 operating system has a newly added feature to track system resource usage, specifically process and...
29 1

Artifacts

Operating System
  • Linux
  • Mac
  • Windows
Time zone information
15

Artifacts

Operating System
Mac
The new Unified Logging and Tracing System for iOS and macOS uses Activity Tracing for performance, consolidates kernel and...
18
Windows contains a number of registry entries under UserAssist that allows investigators to see what programs were recently...
23

Artifacts

Operating System
Windows
"Timeline is like a browser history, but for your whole computer; it provides a chronology which not only contains...
53 results - showing 41 - 53
1 2 3
Results per page: