Daily Archives: May 28, 2014

Windows 8 Hives Not Saved On The Fly

*********After reading, please see this post for the conclusion********* Whilst playing about with USB devices to start my upcoming USB identification series I noticed something a little odd. I captured the locked files on the VM when I started this … Continue reading

Posted in Windows Forensics, Windows Registry Forensics | Tagged , , , , , | 2 Comments