Posts tagged "evidence"
- Amcache forensics: how to find evidence of execution
Use Amcache.hve to prove a program ran on Windows: acquire, parse, filter, pivot on SHA-1, corroborate — plus the limits that catch analysts out.
2026-06-12
Use Amcache.hve to prove a program ran on Windows: acquire, parse, filter, pivot on SHA-1, corroborate — plus the limits that catch analysts out.
2026-06-12