drop prefetch shimcache amcache or 4688 evtx csv · detect execution of known anti-forensic tools · identify cleaners wipers and evidence destruction utilities · surface when and how evidence destruction occurred · runs locally
execution artifacts
drop prefetch / shimcache / amcache / evtx / bam csv
or click
sdelete · bleachbit · ccleaner · eraser · evidence eliminator · 300+ signatures
drop prefetch · shimcache · amcache · 4688 evtx · bam csv