Low level events • Low level timelines • High level events ... - DFRWS
Low level events • Low level timelines • High level events ... - DFRWS
Low level events • Low level timelines • High level events ... - DFRWS
SHOW LESS
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Currently identified data<br />
provenance<br />
<strong>•</strong> offset, e.g. in a Registry hive, index.dat,<br />
$mft<br />
<strong>•</strong> sql statement, e.g. places.sqlite<br />
<strong>•</strong> line number, e.g. setupapi.log
Change language