Notifications
Clear all
Topic starter
17/01/2007 7:45 am
Hello All,
Can anyone point me towards some good documentation on the web, or in print, that could explain how one can identify applications that have been removed (uninstalled) from Windows 2000 or XP workstations?
The situation I'm in does not permit me to image the hard drive in question and examine it with a real forensic tool. I can only browse the system remotely in its live state.
Thank you,
DP
18/01/2007 3:02 am
> Can anyone point me towards some good documentation on the web, or in
> print, that could explain how one can identify applications that have been
> removed (uninstalled) from Windows 2000 or XP workstations?
There is none available that I am aware of…it would have to be written.