What a Windows feature update resets, what survives, the four timestamp traps it sets, and DeviceMigration: a pre-upgrade device timeline nobody parses. With a paste-and-decode upgrade history tool, a PowerShell triage script, an offline hive parser, a RECmd batch file and a Velociraptor artifact.
Where AI coding agents keep their evidence, the fingerprint they leave in the process tree, how transcripts disappear, where the poison sits, and a free triage kit for PowerShell, bash, KAPE, Velociraptor, Kansa, Intune, Sigma and KQL.
At 09:52 a finance user forwarded an invoice email to the phishing mailbox with one line: “Opened the invoice and signed in to view it, then it just went blank.” That sentence is the whole incide...
How do you prove that the file a user downloaded 15 days ago is the exact same file you downloaded today, when the file is gone, nobody recorded a hash, and the only thing left is the browser’s his...
Where Is This Access Point? Geolocating a WiFi BSSID, the Forensic Way In the previous post, the Widgets feed’s location requests carried clientLocationProvider=WiFi. Windows had located itself fr...
Where Was This Laptop? Device Geolocation Hiding in WebCacheV01.dat Windows has no “location history” artifact that you can open and read. There is no table of places the laptop has been. And yet...
Guest in C:\Windows\Prefetch: How ADS Can Hide Execution Evidence C:\Windows\Prefetch is normally a predictable directory. Most systems contain .pf files, Layout.ini, and the ReadyBoot directory. ...
PhonePe Forensics in iOS Audience: Digital forensic examiners, mobile DFIR practitioners, cybercrime investigators, and legal/compliance professionals working UPI fraud cases. Scope: Full-sp...
Amcache ProgramId — Connecting Independent DLLs to Their Parent Applications 1. What Is ProgramId — Plain & Simple ProgramId is a unique hash identifier assigned to every software package tra...
DoH: How DNS Hides Inside HTTPS — And Why Attackers Love It DNS over HTTPS (DoH) encrypts DNS queries inside standard HTTPS. That’s it. One sentence. But the forensic and security implications of ...