Daily Blog #563: Forensic Lunch Test Kitchen 12/10/18

Syscache.hve Limitations and Purpose by David Cowen - Hacking Exposed Computer Forensics Blog



Hello Reader,
         Another test kitchen down! This time we went back to the Syscache.hve in Windows 7 trying to understand its limitations and its purpose in the operating system. Here is what we found:

  • Programs executed from the Desktop whether from the command line or GUI were not being inserted into the Syscache.hve
  • Programs executed from a temp directory made on the Desktop were being recorded in the Syscache.hve
  • There are some sysinternals programs that are not being captured at all, these may not need any shiming

You can watch the video here:


Also Read: Daily Blog #562 

Post a Comment