NTFS directory indexes ($I30 INDX records) for forensics: every entry with its $FILE_NAME times and sizes, and the deleted and renamed entries left in index…
Office document metadata for forensics: authors, last saved by, created, saved and printed times, edit time, counts, company and template, from 97-2003…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
Application text logs for forensics: vsftpd, PostgreSQL, Debian popularity-contest, Snort and Suricata fast alerts, Google logging (glog), Santa, macOS…
Windows Portable Executable (PE) metadata for forensics: compile time, type, sections, imports, exports, import hash, version information, PDB path, resource…
Internet Explorer 4 to 9 cache and history files (index.dat) for forensics: cached URLs with their files and HTTP headers, visited pages, redirects, leaked…
Disk images for forensic intake: raw and split raw images, GPT and MBR partitions, NTFS (alternate data streams, compression), FAT and exFAT file listing with…