Skip to content
RecentFileCache

Posts tagged: #investigation

← Back to all posts
Investigating a Win7 host with the BCF: a short walkthrough
A SOC-flagged Win7 endpoint, 14 paths in the BCF, three worth a second look. A realistic corroboration chain and how much the BCF actually contributed.
recentfilecachedfircase-studywindows-forensics