Windows diagnostic data (EventTranscript.db) for forensics: telemetry events with their time, program, producer, tags and payload: browsing, app use, installs,…
macOS and FreeBSD audit trails (BSM, OpenBSM) for forensics: every audited event with its subject, paths, arguments, sockets and return, read without libbsm.
The MessageFormat 2 date/time functions of Rust MF2 — :datetime, :date, :time and unannotated date/time values: operand and option semantics, time zones, and…
Pure Rust library and CLI utility for optical and storage disc image heuristics, inspection, and format detection (CD, DVD, GDI, Hard Disk, LaserDisc, CHD).
Office document metadata for forensics: authors, last saved by, created, saved and printed times, edit time, counts, company and template, from 97-2003…
CUPS print jobs for forensics: the IPP control files in the spool (/var/spool/cups, macOS and Linux): who printed what, from which application and host, to…
VMware ESXi for forensics: the host configuration (esx.conf), the VM inventory (vmInventory.xml), VM settings (.vmx) and snapshots (.vmsd): what ran on the…
The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last…