Posts tagged: #acquisition

Practical guide to pulling RecentFileCache.bcf in three settings: a running Windows 7 endpoint, a forensic disk image, and a Volume Shadow Copy.