Richard Davis has posted another video as a part of his “Introduction to Windows Forensics”, which shows three additional artifacts that provide evidence of program (application) execution: Windows Application Compatibility Cache (Shimcache), RecentFileCache.bcf, and Amcache.hve.

Load More Related Articles
Load More In Videos

Leave a Reply

Your email address will not be published. Required fields are marked *