Finding evidence of...
 
Notifications
Clear all

Finding evidence of data on removable media

12 Posts
6 Users
0 Reactions
1,154 Views
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

If you're going to be parsing the Registry files, you can always use my offline Registry parser, from http//www.windows-ir.com/regparse.zip. It's Perl, it's free, and it wasn't sold to Paraben. lol

H. Carvey
"Windows Forensics and Incident Recovery"
http//www.windows-ir.com
http//windowsir.blogspot.com


   
ReplyQuote
 Andy
(@andy)
Reputable Member
Joined: 21 years ago
Posts: 357
 

Alan has kindly provided his excellent WRA guide pdf (for those who have asked for it in the past). It can be downloaded from www.innovision-forensics.co.uk/download/WRA_Guidance.pdf

I've also 'uploaded' it to the downloads section…

Andy


   
ReplyQuote
Page 2 / 2
Share: