readyboost usb cache artifact and deletion detector — free browser tool | fatcousin

home

drop mft csv and registry export · detect readyboost cache files deleted from usb devices · identify evidence of usb-based memory cache destruction · surface emDMgmt registry entries for previously connected readyboost devices · runs locally

mft csv · registry export

drop mft csv · registry export · optional system evtx csv (multi-file)

or click

Select file

HKLM\...\EMDMgmt · ReadyBoost.sfcache on USB root · USBSTOR correlation · system events 2003/2004

drop mft csv and registry export · EMDMgmt · ReadyBoost.sfcache · optional system evtx for USB 2003/2004