Windows Forensics

Update:  BlackLight 2019 R3 parses Unified Logs.  For more information see https://www.blackbagtech.com/blog/making-sense-of-unified-logs. Starting with the release of macOS Sierra 10.12, Apple began changing over to a...

In our last blog we laid the foundations of what the Registry is, and how it is structured.  In this blog we are going to...

The Windows Registry is a centralized hierarchical database that contains both system and user information and settings for Windows computers.  These settings can be anything...

As many well know, Apple and Microsoft products are not always easily compatible. We have discovered that some Apple emojis found on Mac OS X...

Analyzing the contents of RAM has been a hot button topic for some time now.  It makes sense in a lot of ways, after all...

Windows 10 Jump List Forensics: When Microsoft released Windows 7, a new artifact was released to the forensic world, Jump Lists.  Since that time most examiners...

With the proliferation of cheap external USB devices, it is becoming incumbent on examiners to determine if any USB attached storage has connected to the...

Next up in our Windows Forensic Essentials Blog Series is a look at Volume Shadow Copies. Looking for other blog posts in this series? We have...

Welcome to the third post in our Windows Forensic Essentials Blog Series. View our previous posts on Jump Lists and the Recycle Bin. Windows Event Logs...

This is the second post in our Windows Forensic Essentials Blog Series. Read our first post on Jump Lists. One of the most overlooked artifacts on...