Forensic Windows Part 15: Tracing USB Device History
Learn how to trace USB devices in Windows using Registry keys, logs, and NirSoft tools to identify devices, users, and dates.
Read the postLearn how to trace USB devices in Windows using Registry keys, logs, and NirSoft tools to identify devices, users, and dates.
Read the postExplore how public detection rules help defenders, how attackers bypass them, and why behavioral detection must complement signatures.
Read the postLearn how device trust secures BYOD and contractor access without MDM, using continuous posture checks and Zero Trust controls.
Read the postLearn how to find, access, and extract data from Windows Shadow Copies with vssadmin, mklink, and ShadowCopyView.
Read the postLearn how to analyze Windows Jump Lists with JLECmd, extract usage traces, and correlate artifacts for stronger forensic timelines.
Read the postDiscover where MFA fails in hybrid environments and how to close Active Directory blind spots with Specops Secure Access.
Read the postTryCloudflare Quick Tunnels are showing up in Google search results. Learn why this happens and how to protect exposed local services.
Read the postLearn how Specops Verified ID uses ID scanning, liveness detection, and directory matching to stop impersonation. Discover how it works.
Read the postLearn how to acquire and analyze the SRUM SRUDB.dat database with KAPE and SrumECmd to uncover app, network, and user activity.
Read the postLearn how to extract and analyze the NTFS MFT with KAPE and MFTECmd to recover file activity, deleted traces, and key timestamps.
Read the postDiscover SafeLine WAF, its semantic detection engine, anti-bot features, Docker Compose setup, and real-world attack testing.
Read the postLearn how to analyze the NTFS USN Journal with MFTECmd to recover file creation, renaming, moving, and deletion traces.
Read the postLearn how to harden Chrome, Edge, and Firefox with GPOs to block password leaks, sync abuse, risky extensions, and stolen sessions.
Read the postLearn how to check if your identity was used after state data breaches with official tools for FranceConnect, FICOBA, Banque de France and more.
Read the postLearn how the Windows Recycle Bin reveals deleted file paths, timestamps, and user SIDs with RBCmd in a forensic investigation.
Read the post