Skip to content
RecentFileCache

Posts tagged: #artifact-limitations

← Back to all posts
Limits of the BCF: when it tells you nothing, and what to use instead
No timestamps, no hashes, no user attribution, no script tracking. The RecentFileCache.bcf is narrower than its reputation. Here is what to reach for.
recentfilecachedfirwindows-forensicsartifact-limitations