Windows File History catalogs (Catalog1.edb, Catalog2.edb) for forensics: every file and folder backed up, with its path, times, attributes and USN, and the…
The locate database (mlocate.db, updatedb) for forensics: every directory indexed with its modification time and the names in it, from a Linux system's last…
Windows Volume Shadow Copies (VSS) in an NTFS volume: every snapshot with its times, GUIDs and machine names, and each snapshot's view of the volume as a Read…
Browser history for forensics: visits and downloads from Chromium-family History databases (Chrome, Edge, Brave, Opera, Vivaldi), Firefox places.sqlite and…
macOS and FreeBSD audit trails (BSM, OpenBSM) for forensics: every audited event with its subject, paths, arguments, sockets and return, read without libbsm.
Cloud and SaaS audit logs for forensics: AWS CloudTrail, the Microsoft 365 unified audit log, Entra ID sign-ins and audits, Azure activity, Google Cloud audit…
Priority Queue is more specialized data structure than Queue. Like ordinary queue, priority queue has same method but with a major difference. In Priority…
Microsoft Defender for forensics: its detection history files (what was detected, where, when, by which process, for which user, and the file's SHA-256) and…