DFSP # 020 - Amcache Forensics - Find Evidence of App Execution

Published: July 5, 2016, 1:30 p.m.

This week I talk about Amcache Forensics, a Windows artifact that collects details about programs that have been run on a given system. This evidence can support malware/ intrusion investigations, file use and knowledge exams and data spoliations inquiries.