Search the forensics blog

Find articles on ShimCache, AmCache, Prefetch and Windows program-execution evidence.

Open-source forensic tool. Timestamps reflect the last-modified time of the executable file, not execution time.

Search Forensics blog →

Language:English Français Español Deutsch Italiano Português 日本語中文