Skip to content
  • About
  • Contact
  • Posts
  • Find Me
  • Awesome BEC
  • This week in 4n6
  • RULER Project
  • LinkedIn
  • BlueSky
  • Twitter
  • GitHub
Search
Close

ThinkDFIR

random musings on DFIR topics

Tag: knowledgec

Updating the KnowledgeC Parser

March 21, 2019March 21, 2019 Phill MooreLeave a comment

Knowledge-is-Power

I’ve just pushed up some changes to the amazing KnowledgeC plist extraction and parsing utility that I’ve been working on with Alexis Brignoni and wanted to describe them here.

Read More »

Recent Posts

  • Are we going to stop calling it Amcache??
  • A question about arbitrary values in USB registry keys
  • Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate
  • Examining the IconCache database
  • Sometimes Windows and PE Version information don’t get along
  • Cached screenshots on Windows 11
  • Sunday Funday – Searching for searching
  • SRUMday Funday!
  • Windows11 Wordwheelquery Woes
  • How can I be of WebAssist(ance)?

Enter your email address to follow this blog and receive notifications of new posts by email.

Archives

logo

Recent Posts

  • Are we going to stop calling it Amcache?? September 4, 2026
  • A question about arbitrary values in USB registry keys August 20, 2026
  • Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate April 25, 2026
  • Examining the IconCache database December 28, 2025
  • Sometimes Windows and PE Version information don’t get along July 28, 2025
Website Powered by WordPress.com.
Back to top
  • Subscribe Subscribed
    • ThinkDFIR
    • Join 77 other subscribers
    • Already have a WordPress.com account? Log in now.
    • ThinkDFIR
    • Subscribe Subscribed
    • Sign up
    • Log in
    • Report this content
    • View site in Reader
    • Manage subscriptions
    • Collapse this bar
Loading Comments...
Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy