The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last…
Windows File History catalogs (Catalog1.edb, Catalog2.edb) for forensics: every file and folder backed up, with its path, times, attributes and USN, and the…
Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps…
Windows Portable Executable (PE) metadata for forensics: compile time, type, sections, imports, exports, import hash, version information, PDB path, resource…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
Take custody of Windows child processes: exact handle inheritance, kill-on-close jobs, launches into another session's token, and SDDL-secured pipes. Not a…
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
Windows BITS job queues for forensics: qmgr.db (Windows 10 and later) and qmgr0.dat/qmgr1.dat (XP to 8.1), each job's owner, files and the command it runs when…
Sylphx Build's build lease: the Sandboxes lease request of a build, waiting for the machine, the guest daemon's process stream, and how a fault is judged.…
SQL databases for the RustStream messaging framework through sqlx: a transactional outbox over any RustStream broker and task queues in Postgres, MySQL/MariaDB…
