One of our favorite forensicators РDavid Cowen, Рhas published a very interesting post in Hacking Exposed Computer Forensics blog. In the post he notes, that now Windows on its own and without user request is removing unused device entries from the registry on a regular basis driven by Task Scheduler. These artifacts might be extremely useful for your cases, so make sure you have read this post.

Load More Related Articles
Load More In Tips & Tricks

Leave a Reply

Your email address will not be published. Required fields are marked *