Are you sure you extract all the available Volume Serial Numbers (VSNs) that reside in the Windows 10 Event Log “Microsoft-Windows-Partition%4Diagnostic.evtx”?  

December 2, 2020 , atropos4n6

This time we shall see, how we can utilize windows’ event logs in order to locate the VSN of a desired removable device and determine if it changes and when.

Has the user logged into this account, or not? (Google Chrome’s Web Data-Part 2)  

September 26, 2020 , atropos4n6

This time I searched for artifacts that can help us determine if and when a user has logged in to her Google Account, using Google Chrome browser. Check this out.

Has the user logged into this account, or not? (Google Chrome’s Login Data-Part 1)  

September 15, 2020 , atropos4n6

Has the user logged in, or not? How sure can we be, when we examine Google Chrome and we want to answer this question? Dive in to find out.

Artifacts of Dropbox Usage on Windows 10 (Part 2)  

September 8, 2020 , atropos4n6

Second part of Dropbox forensics and in this post we will see what artifacts remain after using Mozilla Firefox and Google Chrome to access this cloud service.

Artifacts of Dropbox Usage on Windows 10 (Part 1)  

September 4, 2020 , atropos4n6

This post is all about Dropbox and the artifacts it may leave in a Windows 10 machine.