Application text logs for forensics: vsftpd, PostgreSQL, Debian popularity-contest, Snort and Suricata fast alerts, Google logging (glog), Santa, macOS…
Windows NT to XP and Server 2003 event logs (.evt) for forensics: every record in log order, those recovered from the free space, with times, event ids,…
Windows File History catalogs (Catalog1.edb, Catalog2.edb) for forensics: every file and folder backed up, with its path, times, attributes and USN, and the…
Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps…
Windows Portable Executable (PE) metadata for forensics: compile time, type, sections, imports, exports, import hash, version information, PDB path, resource…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
Take custody of Windows child processes: exact handle inheritance, kill-on-close jobs, launches into another session's token, and SDDL-secured pipes. Not a…
The behaviour of a preset.nz desktop app: one command table feeding the native menu and the toolbar, Undo and Redo that say what they undo, text-field undo…
