macOS Unified Logs (tracev3, timesync, uuidtext and shared cache strings) for forensics: every log entry with its time, process, subsystem, format string and…
A native Rust encoder and decoder of TOML-formatted files and streams. Providesimplementations of the standard Serialize/Deserialize traits for TOML data…
Windows image caches for forensics: Explorer's thumbcache and iconcache databases (every thumbnail with its cache id, checksums and image bytes) and the RDP…
Windows BITS job queues for forensics: qmgr.db (Windows 10 and later) and qmgr0.dat/qmgr1.dat (XP to 8.1), each job's owner, files and the command it runs when…
Read a code change's prognosis before it ships: like terraform plan, for code — what a diff touches, how far it reaches through its callers, and what in that…
Cloud sync clients' records for forensics: Dropbox's sync history, Google Drive's snapshot of cloud and local files with their paths, and its sync log.
Messaging apps' databases for forensics: Skype's main.db, with its accounts, contacts, chats and messages, calls and their members, SMS and file transfers.
NTFS directory indexes ($I30 INDX records) for forensics: every entry with its $FILE_NAME times and sizes, and the deleted and renamed entries left in index…
macOS Spotlight store databases (store.db, .store.db) for forensics: every file Spotlight indexed, with its name, kind, content type and times (added, used,…
Windows File History catalogs (Catalog1.edb, Catalog2.edb) for forensics: every file and folder backed up, with its path, times, attributes and USN, and the…
The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last…
