Posts tagged "deleted-files"

• Recovering deleted-binary evidence from Amcache

  Amcache outlives the binaries it records. Path, SHA-1, publisher, link date, and inventory time persist for months after the attacker wipes the file. The practical workflow.

  2026-05-24