ThinkDFIR thinkdfir.com

Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate

thinkdfir.com·4w

Examining the IconCache database

thinkdfir.com·20w

A question about arbitrary values in USB registry keys

thinkdfir.com·25w

Sometimes Windows and PE Version information don’t get along

thinkdfir.com·42w

Cached screenshots on Windows 11

thinkdfir.com·49w

Sunday Funday – Searching for searching

thinkdfir.com·63w

SRUMday Funday!

thinkdfir.com·70w

Windows11 Wordwheelquery Woes

thinkdfir.com·81w

How can I be of WebAssist(ance)?

thinkdfir.com·132w

CPY JMP

thinkdfir.com·157w

Timestamps in INDX Entries

thinkdfir.com·175w

Tracking screenshots with LNK files

thinkdfir.com·223w

I can see and hear you seeing and hearing me!

thinkdfir.com·228w

Introducing Awesome BEC

thinkdfir.com·238w

You want me to deal with how many VMDKs!?

thinkdfir.com·259w

Log in to enable infinite scrolling