windows forensics

FortiGuard Labs has revealed that a little‑known Windows telemetry file — AutoLogger‑Diagtrack‑Listener.etl — can contain usable forensic traces of process execution, including evidence of deleted malware and attacker activity, offering incident responders an unexpected secondary source of truth...

In the fast-paced world of cybersecurity, where digital threats evolve as rapidly as technology itself, having the right tools for investigating incidents is paramount. As incident investigators can attest, Windows event logs have long been the bread and butter of forensic activities, lighting...

http://arstechnica.com/microsoft/news/2009/12/protect-yourself-from-cofee-with-some-decaf-1.ars Two developers have created "Detect and Eliminate Computer Assisted Forensics" (DECAF). The tool tries to stop Microsoft's Computer Online Forensic Evidence Extractor (COFEE), which helps law...