www.it-connect.fr
Windows Forensics, Part 6: Analyzing Image Caches
Learn how to analyze Windows icon and thumbnail caches with Thumbcache Viewer, recover traces, and correlate artifacts for forensics.
Read the postAuthor: Mehdi Dakhama
Forensic Windows Part 5: Analyzing BAM and DAM
Learn how to analyze BAM and DAM registry artifacts on Windows to trace recent program executions, user activity, and incident response evidence.
Read the post
Active Directory Security: Auditing LAPS Delegations and Detecting ACL Flaws
Audit Active Directory LAPS delegations, spot risky ACLs on computer objects, and secure passwords. Learn how to detect and fix the issue.
Read the post
Forensic Windows – Part 4: Exploiting SuperFetch Artifacts
Learn how SuperFetch artifacts reveal Windows execution history, where to find them, and how to analyze them with SysMainView.
Read the post
How to Verify the Authenticity of Microsoft and Linux Installation ISOs with CheckISO
Learn how to verify Microsoft and Linux ISO authenticity with hashes, GPG, and CheckISO to reduce supply chain risk and avoid tampered images.
Read the post
Windows Forensics Part 3: Tracking Program Execution with Prefetch
Learn how Prefetch reveals Windows program execution traces and how to analyze it with WinPrefetchView and PECmd for forensics.
Read the post
Forensic Windows Part 2: How to Find Evidence with Amcache
Learn how to use Amcache in Windows forensics to uncover executed and deleted tools, device traces, and key metadata. Discover the limits too.
Read the post
How to Detect and Block Brute Force Attacks on Windows Server with PowerShell
Detect and block brute force attacks on Windows Server with PowerShell scripts. Learn how to analyze logs, spot suspicious IPs, and automate blocking.
Read the post
How to Find Windows Forensic Traces with ShimCache – Part 1
Learn how ShimCache helps uncover Windows activity traces, spot suspicious files, and kick off a fast forensic analysis.
Read the post