Skip to content
  • About
  • Contact
  • Find Me
  • Posts
  • LinkedIn
  • Twitter
  • GitHub
  • This Week In 4n6
Search
Close

ThinkDFIR

random musings on DFIR topics

Find Me

You can see my upcoming teaches for the FOR500 and FOR528 classes here

Share this:

  • Share on X (Opens in new window) X
  • Share on Facebook (Opens in new window) Facebook
Like Loading...

Recent Posts

  • Examining the IconCache database
  • A question about arbitrary values in USB registry keys
  • Sometimes Windows and PE Version information don’t get along
  • Cached screenshots on Windows 11
  • Sunday Funday – Searching for searching
  • SRUMday Funday!
  • Windows11 Wordwheelquery Woes
  • How can I be of WebAssist(ance)?
  • CPY JMP
  • Timestamps in INDX Entries

Enter your email address to follow this blog and receive notifications of new posts by email.

Archives

logo

RSS SANS Teaching

  • An error has occurred; the feed is probably down. Try again later.

Recent Posts

  • Examining the IconCache database December 28, 2025
  • A question about arbitrary values in USB registry keys November 23, 2025
  • Sometimes Windows and PE Version information don’t get along July 28, 2025
  • Cached screenshots on Windows 11 June 13, 2025
  • Sunday Funday – Searching for searching March 8, 2025
Website Powered by WordPress.com.
Back to top
  • Subscribe Subscribed
    • ThinkDFIR
      • Join 78 other subscribers
    • Already have a WordPress.com account? Log in now.
    • ThinkDFIR
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Copy shortlink
    • Report this content
    • View post in Reader
    • Manage subscriptions
    • Collapse this bar
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy
%d