Posts tagged "deleted-files"
- Recovering deleted-binary evidence from Amcache
Amcache outlives the binaries it records. Path, SHA-1, publisher, link date, and inventory time persist for months after the attacker wipes the file. The practical workflow.
2026-05-24