Posts Tagged ‘windows 10 forensics’

Foremost is a console program for carving files based on its headers, footers and internal data structure. Utility Foremost wrote two special agents of the US Air Force from the special department. investigations. It is an extremely useful tool and very easy to use, but with its shortcomings. Foremost does not restore the folder structure and retains original file names and tags.

Obsidianforensics has created a new tool ‘Hindsight’. Hindsight is a free tool for analyzing web artifacts. In top, it can be used for Internet history forensics for Google Chrome/Chromium.

This article is devoted to the tool that extracts various artifacts from the AD environment into a specially formatted Microsoft Excel. ADRecon can be ran from any workstation that is connected to the environment.

Computer attacks constantly worry administrators and computer users. Earlier we already talked about volatility.

Plugin for the platform Volatility Framework, whose goal is to extract the encryption keys Full Volume Encryption Keys (FVEK) from memory. It works from Windows 7 to Windows 10. Unfortunately, the support for Windows 8 – 10 is very experimental, but it works in most cases with a few quirks.