How do you prove that the file a user downloaded 15 days ago is the exact same file you downloaded today, when the file is gone, nobody recorded a hash, and the only thing left is the browser’s his...
Where Is This Access Point? Geolocating a WiFi BSSID, the Forensic Way In the previous post, the Widgets feed’s location requests carried clientLocationProvider=WiFi. Windows had located itself fr...
Where Was This Laptop? Device Geolocation Hiding in WebCacheV01.dat Windows has no “location history” artifact that you can open and read. There is no table of places the laptop has been. And yet...
Guest in C:\Windows\Prefetch: How ADS Can Hide Execution Evidence C:\Windows\Prefetch is normally a predictable directory. Most systems contain .pf files, Layout.ini, and the ReadyBoot directory. ...
PhonePe Forensics in iOS Audience: Digital forensic examiners, mobile DFIR practitioners, cybercrime investigators, and legal/compliance professionals working UPI fraud cases. Scope: Full-sp...
Amcache ProgramId — Connecting Independent DLLs to Their Parent Applications 1. What Is ProgramId — Plain & Simple ProgramId is a unique hash identifier assigned to every software package tra...
DoH: How DNS Hides Inside HTTPS — And Why Attackers Love It DNS over HTTPS (DoH) encrypts DNS queries inside standard HTTPS. That’s it. One sentence. But the forensic and security implications of ...
In enterprise security, one of the biggest challenges is maintaining visibility and control over endpoints—especially when threats involve OS reinstalls, hard drive replacements, or rogue devices. ...
What are these HKCR, HKCU, HKLM 💭 The Windows Registry is the foundation of evidence in many digital investigations. Understanding the differences among its root hives—HKCR, HKCU, HKLM, HKU, and...
Windows 11 PCA Artifact In the rapidly evolving landscape of digital forensics, the discovery of new artifacts is a rare and exciting event. Windows 11 version 22H2 introduced a significant new f...