August 2017
Beginner to intermediate
274 pages
8h 11m
English
Windows Artifact Parser walks through the image added to the case and extracts information from the LNK files it finds, including those from unallocated space if this option has been chosen by the examiner. Once the process is finished, the examiner can then analyze, bookmark, and add this information to their report.
Read now
Unlock full access