8 skills · sorted by relevance
Parse Windows Prefetch files, which store traces of program execution, to extract run counts, timestamps, and referenced files. Build execution timelines and compare findings with other forensic evidence when investigating suspicious software or tool usage.
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files to determine program execution history including run counts, timestamps, and referenced files for forensic investigation.
The English summary is being prepared. Showing the original description.
Analyze Windows Prefetch files, which record application execution data, using Python. Reconstruct execution timelines, review run counts and accessed resources, and identify suspicious programs or signs that an executable has been renamed to disguise its identity.
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
The English summary is being prepared. Showing the original description.
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
The English summary is being prepared. Showing the original description.