Windows image caches for forensics: Explorer's thumbcache and iconcache databases (every thumbnail with its cache id, checksums and image bytes) and the RDP…
The native Host of mf2-runtime (servers, tests, wasm32-wasip1): NFC through unicode-normalization, float text through ryu, time-zone offsets through jiff's…
Windows text logs for forensics: Program Compatibility Assistant (execution, Windows 11), IIS and Windows Firewall (W3C), PowerShell transcripts, TeamViewer…
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
SQL databases for the RustStream messaging framework through sqlx: a transactional outbox over any RustStream broker and task queues in Postgres, MySQL/MariaDB…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps…
The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last…
Browser history for forensics: visits and downloads from Chromium-family History databases (Chrome, Edge, Brave, Opera, Vivaldi), Firefox places.sqlite and…
Linux login records (utmp, wtmp, btmp, lastlog, wtmpdb, lastlog2): glibc's struct utmp and struct lastlog in their 32- and 64-bit-time layouts, either byte…
Windows Server User Access Logging (UAL, the Sum folder's .mdb databases) for forensics: which accounts and addresses used which server role, when, and how…