Sitemap
Index of every page on RecentFileCache Parser — the homepage parser, all blog posts, series pages, glossary terms, and policy pages, in one list.
Home
Blog
- The Application Experience appraisal task: when the BCF gets written, and when it gets cleared
- The RecentFileCache.bcf file format, in plain terms
- Investigating a Win7 host with the BCF: a short walkthrough
- Limits of the BCF: when it tells you nothing, and what to use instead
- RecentFileCache.bcf: the quiet artifact most analysts forget about
- RecentFileCache vs AmCache: which one is on your host, and why
- Acquiring RecentFileCache.bcf from live and offline systems
- Detecting RecentFileCache tampering
- Triage: spotting suspicious entries in RecentFileCache
- Validating RecentFileCache findings: pivots and false positives
- Application Experience & ProgramDataUpdater: how .bcf gets populated
- The .bcf format, byte-by-byte
- RecentFileCache vs Amcache vs Prefetch vs ShimCache
- What is RecentFileCache.bcf?