Content Industry: Enterprise

ShimCache vs AmCache: Key Windows Forensic Artifacts

By

In digital forensics, Windows operating systems leave behind a wealth of forensic artifacts that can be invaluable in investigations. Among the key artifacts are ShimCache (Application Compatibility Cache) and AmCache (Application Activity Cache). These artifacts can provide valuable insights into program execution and file system interaction, often essential in piecing together an event timeline or … Continued

Magnet Axiom Cyber 8.6: Linux support for MITRE ATT&CK framework integration, Comae memory analysis improvements, and offline access to Magnet Copilot

By

The latest release of Magnet Axiom Cyber introduces several improvements for examiners working on a variety of investigation types, from incident response to internal investigations.   Magnet Axiom Cyber 8.6 includes an array of new features and improvements, such as:  We’ve also updated and added to our artifact support (full details at the end of … Continued

The importance of PowerShell logs in digital forensics 

By

PowerShell is a powerful tool within Windows systems, widely used for administrative tasks, automation, and scripting. Unfortunately, due to its powerful scripting capabilities and default presence on Windows machines, it has also become a popular tool for malicious actors. PowerShell can be used in advanced attacks, including fileless malware, lateral movement within a network, and … Continued

5 iOS forensics evidence sources to capture before they expire

By

Time is always critical when dealing with criminal investigations, but did you know that some iOS forensics evidence will be lost entirely if it isn’t extracted within a certain window of opportunity? To help avoid any lost data during mobile forensic data extraction, we have outlined the best iOS evidence sources to capture before expiration, … Continued