Posts tagged "deleted-files"

• Recovering deleted-binary evidence from Amcache

  When an attacker deletes a binary, Amcache often preserves its hash, path, publisher, and inventory time. A practical workflow for using Amcache to investigate wiped artefacts.

  2026-05-24