drop any combination of evtx mft prefetch shimcache registry and browser csvs · score absent expected artifacts · classify systematic vs random absence · runs locally
artifact sources
drop evtx · mft · prefetch · shimcache · registry · browser · usn · bam csv
or click
auto-detects artifact type from column headers · scores missing high-value sources · correlates grouped absences
drop evtx · mft · prefetch · shimcache · registry · browser · usn · bam csv