8 个 · 按相关度排序
Reconstruct Windows folder browsing activity from Shellbag registry records using SBECmd and ShellBags Explorer. Investigate traces of deleted directories, disconnected USB drives, and network shares while accounting for limits in what the records and timestamps show.
中文简介正在准备中。当前显示英语简介。
Examine Windows shortcuts and Jump Lists, records of recently used files, to reconstruct user activity. Extract paths, timestamps, and device details with LECmd and JLECmd, including traces that remain after target files are deleted.
中文简介正在准备中。当前显示英语简介。
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
中文简介正在准备中。当前显示原文说明。
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
中文简介正在准备中。当前显示原文说明。
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
中文简介正在准备中。当前显示原文说明。
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
中文简介正在准备中。当前显示原文说明。
Analyze Windows Shellbag registry artifacts to reconstruct folder browsing activity, detect access to removable media and network shares, and establish user interaction with directories even after deletion using SBECmd and ShellBags Explorer.
中文简介正在准备中。当前显示原文说明。
Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.
中文简介正在准备中。当前显示原文说明。