Windows 10 Timeline

I had a very quick poke around this weekend

https://salt4n6.wordpress.com/2018/05/05/windows-10-timeline-forensic-artefacts/

Well done D

We also had a play with it at the end of last week.

https://cclgroupltd.com/windows-10-timeline-forensic-artefacts/

More work to do, but some encouraging finds in there!

We also had a play with it at the end of last week.

https://cclgroupltd.com/windows-10-timeline-forensic-artefacts/

More work to do, but some encouraging finds in there!

Oooh.. I like that )
Lovely findings you have there! )

We also had a play with it at the end of last week.

https://cclgroupltd.com/windows-10-timeline-forensic-artefacts/

More work to do, but some encouraging finds in there!

Oooh.. I like that )
Lovely findings you have there! )

The UserEngaged stuff has real potential I think - needs more testing to work out precisely how the service populating it works/what its limitations are though.

Im currently testing and working on this but all of a sudden my timeline has stopped recording stuff evil evil evil evil evil evil evil evil evil evil evil evil evil evil evil evil

whilst this is annoying, it also makes me wonder where the hell everything has gone, why has it gone and what impact this has on an investigation.

Belkasoft now has Windows Timeline analysis in our Belkasoft Evidence Center (BEC) 2018. Feel free to contact us to get a trial.