Author: Mehdi Dakhama

Discover how to analyze Chrome and Edge artifacts in Windows forensics: history, downloads, cookies, logins, bookmarks, and more.

Learn how to trace USB devices in Windows using Registry keys, logs, and NirSoft tools to identify devices, users, and dates.

Learn how to find, access, and extract data from Windows Shadow Copies with vssadmin, mklink, and ShadowCopyView.

Learn how to analyze Windows Jump Lists with JLECmd, extract usage traces, and correlate artifacts for stronger forensic timelines.

Learn how to acquire and analyze the SRUM SRUDB.dat database with KAPE and SrumECmd to uncover app, network, and user activity.

Learn how to extract and analyze the NTFS MFT with KAPE and MFTECmd to recover file activity, deleted traces, and key timestamps.

Learn how to analyze the NTFS USN Journal with MFTECmd to recover file creation, renaming, moving, and deletion traces.

Learn how the Windows Recycle Bin reveals deleted file paths, timestamps, and user SIDs with RBCmd in a forensic investigation.

Learn how to locate and analyze Windows ShellBags with SBECmd and ShellBags Explorer to trace folder browsing and renamed paths.

Learn how to analyze Windows LNK files with LECmd to uncover execution traces, paths, and user activity in digital forensics.

Learn how to analyze Windows icon and thumbnail caches with Thumbcache Viewer, recover traces, and correlate artifacts for forensics.

Learn how to analyze BAM and DAM registry artifacts on Windows to trace recent program executions, user activity, and incident response evidence.

Learn how SuperFetch artifacts reveal Windows execution history, where to find them, and how to analyze them with SysMainView.

Learn how to verify Microsoft and Linux ISO authenticity with hashes, GPG, and CheckISO to reduce supply chain risk and avoid tampered images.