Posts tagged "program-execution"

• What the Amcache actually tells you in a DFIR investigation

  A practitioner's view on the Amcache.hve hive: what each entry really proves, where the timestamps lie to you, and the mistakes that keep showing up in incident reports.

  2026-05-27

• Amcache vs Shimcache: which artifact answers which question

  Two adjacent Windows artifacts with very different forensic properties. What each really records, where their timestamps lie, and a decision table for casework.

  2026-05-27