Windows Prefetch: what it proves, and what it does not
Prefetch at the byte level: the SCCA header, MAM compression, the path hash, run times and volumes, with working Python and the limits to state in a report.
Tagged “Windows”
3 posts
-
-
Zone.Identifier: what the Mark of the Web records about a download
How Windows marks downloads in an NTFS alternate data stream: where it lives in the MFT, the zone and URL keys, hunting it at scale, and how it disappears.
-
Reading Windows logon types in event 4624
Logon types, the 4624 fields that change the reading, 4625 failure codes, following a Logon ID through a session, and queries for PowerShell, wevtutil and KQL.