Internet Explorer 4 to 9 cache and history files (index.dat) for forensics: cached URLs with their files and HTTP headers, visited pages, redirects, leaked…
Windows 10/11 notifications (wpndatabase.db) for forensics: toasts, tiles and badges apps raised, with their app, times and visible text, and the apps…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
The BREP PLM server: parts, revisions, lifecycle, checkout, BOMs and change orders over an embedded SQLite store, with a browser UI and the document API the…
The behaviour of a preset.nz desktop app: one command table feeding the native menu and the toolbar, Undo and Redo that say what they undo, text-field undo…
NTFS directory indexes ($I30 INDX records) for forensics: every entry with its $FILE_NAME times and sizes, and the deleted and renamed entries left in index…
Windows Volume Shadow Copies (VSS) in an NTFS volume: every snapshot with its times, GUIDs and machine names, and each snapshot's view of the volume as a Read…
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
Forward-only tabular parsing — delimited text and spreadsheets — with a HyperCast verdict for every cell: an allocation-free, panic-free, no_std core that…