This module demonstrates an in-depth analysis of the artifacts contained within the NTUser. Tools and techniques for post mortem analysis are discussed at length to take users beyond the current use of viewers and into real analysis of data contained in the Registry. Video created by for the course 'Windows Registry Forensics'. This book is one-of-a-kind, giving the background of the Registry to help users develop an understanding of the structure of registry hive files, as well as information stored within keys and values that can have a significant impact on forensic investigations. Historical registry data extraction Background Activity Moderator (BAM) RecentApps key Amcache and Shimcache.
#RECENTAPPS REGISTRY FORENSICS WINDOWS#
Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry, Second Edition, provides the most in-depth guide to forensic investigations involving Windows Registry.
0 kommentar(er)
