windows forensics

DPAPISnoop, a Windows forensics and offensive-security tool described by Cryptika in June 2026, targets the DPAPI CREDHIST file to extract historical password hashes that can be attacked offline, turning an obscure Windows recovery mechanism into a practical credential-recovery and...

FortiGuard Labs has revealed that a little‑known Windows telemetry file — AutoLogger‑Diagtrack‑Listener.etl — can contain usable forensic traces of process execution, including evidence of deleted malware and attacker activity, offering incident responders an unexpected secondary source of truth...

In the fast-paced world of cybersecurity, where digital threats evolve as rapidly as technology itself, having the right tools for investigating incidents is paramount. As incident investigators can attest, Windows event logs have long been the bread and butter of forensic activities, lighting...

http://arstechnica.com/microsoft/news/2009/12/protect-yourself-from-cofee-with-some-decaf-1.ars Two developers have created "Detect and Eliminate Computer Assisted Forensics" (DECAF). The tool tries to stop Microsoft's Computer Online Forensic Evidence Extractor (COFEE), which helps law...