Maxim Suhanov presented聽winmem_decompress – a聽program that tries to extract compressed memory pages from page-aligned data. Such compressed memory pages can be found in virtual memory of Windows 8.1 & 10 operating systems. Learn more about the tool here.
-
Triage Image Creation
This episode of聽“Introduction to Windows Forensics” covers triage image creati… -
Netflix -Windows 10 Appstore Forensics
Justin Boncaldo has written a post about forensic analysis of Netflix app. It seems the ap… -
Efficiently Summarizing Web Browsing Activity
Reviewing web browsing activity is relevant in a wide variety of DFIR cases. With many use…
Load More Related Articles
-
Malcom: Malware Communication Analyzer
Malcom is a tool designed to analyze a system’s network communication using graphica… -
PasteHunter
PasteHunter is a Python3 application that is designed to query a collection of sites that … -
Open Forensic Images with Forensic7z
Forensic7z is a plugin for 7-Zip archiver that can be used for opening and browsing disk i…
Load More In Software
