Forensic Artifacts

54 results - showing 41 - 54
1 2 3
425

Artifacts

Operating System
Windows
Windows maintains connection history of wired and wireless network connections. Registry information here: https://www.dfir.training/resources/downloads/windows-registry
458

Artifacts

Operating System
Windows
Tracks files that have been opened or saved within a Windows shell dialog box. ...
1011

Artifacts

Operating System
Windows
Prefetch files, like any other file in a file system, can be viewed from a digital forensic perspective to...
652
"Program execution launched on a Win10 system is tracked in the RecentApps key" - https://www.andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/ ...
538

Artifacts

Operating System
Windows
The Windows Recycle Bin contains files that have been deleted by the user, but not yet purged from...
runMRU Hot
480

Artifacts

Operating System
Windows
"The MRU in MRU lists stands for "Most Recently Used." The MRU list is a Windows-based application that...
390

Artifacts

Operating System
Mac
pstirparo/mac4n6 https://github.com/pstirparo/mac4n6 mac4n6 https://www.mac4n6.com/...
339

Artifacts

Operating System
Mac
Safari cache URL response
772

Artifacts

Operating System
Windows
"The Microsoft Windows 8 operating system has a newly added feature to track system resource usage, specifically process and...
484 1

Artifacts

Operating System
  • Linux
  • Mac
  • Windows
Time zone information
587

Artifacts

Operating System
Mac
The new Unified Logging and Tracing System for iOS and macOS uses Activity Tracing for performance, consolidates kernel and...
536
Windows contains a number of registry entries under UserAssist that allows investigators to see what programs were recently...
572

Artifacts

Operating System
Windows
"Timeline is like a browser history, but for your whole computer; it provides a chronology which not only contains...
54 results - showing 41 - 54
1 2 3
Results per page: