Skip to content
Timelineparser

Posts tagged: #program-execution

← Back to all posts
Windows Timeline vs SRUM vs Prefetch vs Jump Lists
Windows Timeline, SRUM, Prefetch and Jump Lists compared: what each records, where it lives, how long it lasts and which question each one answers best.
windows-timelinecomparisonprogram-executiondfir
Does Windows Timeline Prove Execution or File Access?
What a Windows Timeline row really proves: file opened, app in focus, time spent. How to word it in a report and which artifacts confirm execution.
windows-timelineactivitiescacheprogram-executioninvestigation