CUPS print jobs for forensics: the IPP control files in the spool (/var/spool/cups, macOS and Linux): who printed what, from which application and host, to…
VMware ESXi for forensics: the host configuration (esx.conf), the VM inventory (vmInventory.xml), VM settings (.vmx) and snapshots (.vmsd): what ran on the…
The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last…
Application text logs for forensics: vsftpd, PostgreSQL, Debian popularity-contest, Snort and Suricata fast alerts, Google logging (glog), Santa, macOS…
Windows NT to XP and Server 2003 event logs (.evt) for forensics: every record in log order, those recovered from the free space, with times, event ids,…
Windows File History catalogs (Catalog1.edb, Catalog2.edb) for forensics: every file and folder backed up, with its path, times, attributes and USN, and the…
Internet Explorer 4 to 9 cache and history files (index.dat) for forensics: cached URLs with their files and HTTP headers, visited pages, redirects, leaked…
Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps…
Windows Portable Executable (PE) metadata for forensics: compile time, type, sections, imports, exports, import hash, version information, PDB path, resource…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
NTFS directory indexes ($I30 INDX records) for forensics: every entry with its $FILE_NAME times and sizes, and the deleted and renamed entries left in index…
The tabnas language server in Rust: diagnostics, outline, semantic tokens, hover and completion for every tabnas grammar, as a library for Rust hosts and a…
Cloud sync clients' records for forensics: Dropbox's sync history, Google Drive's snapshot of cloud and local files with their paths, and its sync log.
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
Dense Mermaid projections of a sealmap Codebase, the seal lockfile and checks that keep hand-written diagram topics true to the code, and bounded review packs
Windows BITS job queues for forensics: qmgr.db (Windows 10 and later) and qmgr0.dat/qmgr1.dat (XP to 8.1), each job's owner, files and the command it runs when…
