Find hiberfil.sys, Notepad cache, UserAssist, Defender logs, registry hives and evidence-integrity guides by the artifact or question you have.
Start with the artifact name you have, then choose the evidence question you need to answer. Each route connects an interpretation guide with the existing subject article where available. Related spellings and acronyms share a route.
Browse all topics below.
Which evidence condition changed, and how can the claim be tested?
Start with collection, interpretation and corroboration. Distinguish a technique category, an observed artifact and an attributed action before drawing a conclusion.
Can a memory-derived fragment establish a browsing event?
Compare the power state, memory source and browser records. A surviving string needs context before it becomes an activity claim.
Read the interpretation guide →
Original subject page in the blog or field manual.
Does session text describe a saved file or a person’s action?
Keep tab/session data, saved files and parser output separate. Compare application versions, settings and independent file records.
Read the interpretation guide →
Original subject page in the blog or field manual.
Which artifact supports this specific execution or usage claim?
Compare the producer and meaning of each record. Application usage, resource accounting and successful execution are different propositions.
Read the interpretation guide →
Original subject page in the blog or field manual.
Original subject page in the blog or field manual.
What did Defender record, and what was outside its coverage?
Preserve provider, channel, build, event fields and collection bounds. A detection, a remediation record and no retained event support different conclusions.
Read the interpretation guide →
Original subject page in the blog or field manual.
What does a matching hash verify, and what remains unproved?
Separate byte equality from source authenticity, collection coverage and handling history. Test each claim against its own supporting record.
Read the interpretation guide →
Original subject page in the blog or field manual.
Which hive, user context and acquisition state produced this value?
Retain hive identity, associated logs, acquisition timing and parser behavior. A key timestamp does not automatically time every contained value.
Read the interpretation guide →
Original subject page in the blog or field manual.
What evidence could support a recoverability or sanitization claim?
Identify the device, allocation layer and tested recovery scope. Historical overwrite discussions need storage-specific qualification.
Read the interpretation guide →
Original subject page in the blog or field manual.
Original subject page in the blog or field manual.
Does this authentication record identify a person or an account event?
Compare the authentication outcome, session context and independent activity. Keep account identity and human attribution as separate conclusions.
Can these timestamps be compared on the same clock basis?
Preserve original representations, offsets, precision and uncertainty. Use the local time worksheet only after the source time basis is established.
Read the interpretation guide →
Original subject page in the blog or field manual.
Does a timestamp discrepancy support manipulation or another cause?
Compare independent metadata producers and ordinary copy, restore or application behavior. A discrepancy is a lead requiring corroboration.
Record collection scope, companion files and transfer checks.
Test coverage and ordinary explanations before assigning a cause.
Compare inputs, versions, settings and raw fields.
Continue to cloud, media, validation and report-review questions.
