For Prefetch files, there is a new carver written that will carve exact file sizes for "windows prefetch" files. These files are extremely useful in Incident Response cases as they can prove "evidence of execution" on a windows system.
Here is the patch by Ralf Almon -- can we get this added to the ...
Search found 1 match
- 25 Jun 2016, 22:59
- Forum: File recovery
- Topic: Custom Signature - adding size offset
- Replies: 3
- Views: 2413