forensic imaging tool artifact detector

drop prefetch shimcache amcache or mft csv · detect forensic imaging tool execution on the suspect machine · identify when the machine was imaged · surface imaging artifacts and write blocker evidence · runs locally