56,966 blogs · [ { "id": "01a08c54-6524-72f3-89c0-a6ff1ad0099a", "title": "Are we going to stop calling it Amcache??", "url": "https://thinkdfir.com/2026/09/04/are-we-going-to-stop-calling-it-amcache/", "published_at": "2026-09-04T12:09:11+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1b0f1df0", "title": "A question about arbitrary values in USB registry keys", "url": "https://thinkdfir.com/2026/08/20/a-question-about-arbitrary-values-in-usb-registry-keys/", "published_at": "2026-08-19T23:00:38+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1b748b24", "title": "Trust but Verify: Amcache’s OriginalFilename Field Isn’t Always Accurate", "url": "https://thinkdfir.com/2026/04/25/trust-but-verify-amcaches-originalfilename-field-isnt-always-accurate/", "published_at": "2026-04-25T12:39:47+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1c30a15e", "title": "Examining the IconCache database", "url": "https://thinkdfir.com/2025/12/28/examining-the-iconcache-database/", "published_at": "2025-12-27T23:45:31+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1c64d9d8", "title": "Sometimes Windows and PE Version information don’t get along", "url": "https://thinkdfir.com/2025/07/28/sometimes-windows-and-pe-version-information-dont-get-along/", "published_at": "2025-07-28T13:29:40+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1d0a1cce", "title": "Cached screenshots on Windows 11", "url": "https://thinkdfir.com/2025/06/13/cached-screenshots-on-windows-11/", "published_at": "2025-06-13T11:09:27+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1e03c8a1", "title": "Sunday Funday – Searching for searching", "url": "https://thinkdfir.com/2025/03/08/sunday-funday-searching-for-searching/", "published_at": "2025-03-07T23:02:49+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1e6f8076", "title": "SRUMday Funday!", "url": "https://thinkdfir.com/2025/01/13/srumday-funday/", "published_at": "2025-01-13T12:48:22+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1f5d516f", "title": "Windows11 Wordwheelquery Woes", "url": "https://thinkdfir.com/2024/10/31/windows11-wordwheelquery-woes/", "published_at": "2024-10-31T09:45:08+00:00" }, { "id": "01a08c54-6524-72f3-89c0-a6ff1f64fded", "title": "How can I be of WebAssist(ance)?", "url": "https://thinkdfir.com/2023/11/09/how-can-i-be-of-webassistance/", "published_at": "2023-11-09T10:55:38+00:00" } ] posts Claim your blog

Blog · corpus.blog/blogs/thinkdfir.com/posts