Archive

2022  5

October  2

$I30 Parsers Output False Entries. Here’s Why

October 29, 2022 · 7 min · 1322 words · Harel Segev

The Forensic Value of the (Other) WSH Registry Key

October 13, 2022 · 2 min · 379 words · Harel Segev

July  3

The Mystery of the HeapLeakDetection Registry Key

July 20, 2022 · 6 min · 1070 words · Harel Segev

Resolving File Paths Using the MFT

July 7, 2022 · 16 min · 3401 words · Harel Segev

Home Adventures! A Prefetch File in $I30 Slack, PyInstaller & Prefetch Hash Cracking

July 2, 2022 · 5 min · 881 words · Harel Segev