SANS Digital Forensics and Incident Response Blog: Tag - Cases Leads

Digital Forensics Case Leads: Registry Forensics, Volume Shadow Copies and Windows 8

It's the "better late than never" edition of Case Leads and I've got lots of great stuff for you this week. Lots of great articles and papers to read, including a very cool post by Andrew Case on recovering registry hives from a system that's been reformatted and had the OS reinstalled, as well as … Continue reading Digital Forensics Case Leads: Registry Forensics, Volume Shadow Copies and Windows 8