Workshop: Windows Artifacts
Posted
What did the user run, and when? This week we dig into the Windows artifacts that answer that question: Prefetch, Shellbags, and LNK files.
Bring a laptop. We’ll provide a disk image and walk through parsing each artifact with free tools. A Windows VM is helpful but not required.