«When it comes to Windows forensics, some of the most valuable evidence can be stored deep inside system directories the average user never touches. One such source of evidence is the System Resource Usage Monitor (SRUM) database. Introduced in Windows 8 and still shipping today with the latest Windows 11 updates, SRUM collects detailed historical […]»
15 August, 2025Oleg Afonin
«Welcome to Part 5 of the Perfect Acquisition series! In case you missed the previous parts, please check them out for background information. This section provides a comprehensive guide to performing the Perfect APFS Acquisition procedure. Perfect Acquisition Part 1: Introduction Perfect Acquisition Part 2: iOS Background Perfect Acquisition Part 3: Perfect HFS Acquisition Perfect […]»
21 July, 2025Elcomsoft R&D
«We previously tested disk imaging speeds using high-performance storage devices. But raw speed is only part of the equation. Even under ideal conditions, getting a fully correct and complete image can be tricky. And achieving peak speed consistently is even harder – many factors can slow things down, and sometimes even corrupt the results. In […]»
10 July, 2025Oleg Afonin