Add your listing here
"Evolving AppCompat/AmCache data analysis beyond grep"
AppCompatProcessor has been designed to extract additional value from enterprise-wide AppCompat / AmCache data be ... Read More...
The Get-Amcache cmdlet parses the Amcache.hve registry hive to derive applications that were recently used. If you don't specify a hive path (-HivePath), the cmdlet parses the C:\Windows\AppCompat\Programs\Amcache.hve.
cafae ?is a Windows registry parser that targets specific registry keys that ... Read More...
© 2019 Copyright | DFIR Training