A 10 Second Journey: Parsing the structure of the Windows 8 Prefetch Artifact
- Jared Atkinson
- Friday, March 7th, 8:00pm - 9:00pm
As Microsoft and other vendors release new Operating System products, forensics researchers must keep up to date with the ever-changing state of available forensic artifacts. This presentation explores the Windows 8 Prefetch file structure, and how the new version of this abundant artifact has become even more potent than ever.
The following bonus sessions are open to all paid attendees at no additional cost. There are many different types of events that fall into these categories:
- SANS@Night: Evening presentations given after day courses have ended. This category includes Keynotes.
- Special Events: SANS-hosted events and other non-technical recreational offerings. This category includes, but is not limited to, Receptions and Information Tables.
- Lunch & Learn: Short presentations given during the lunch break.
|Welcome to SANS
||Wednesday, March 5th, 8:15am - 8:45am
|DFIReception - Forensicators Unite!
||Wednesday, March 5th, 6:00pm - 7:00pm
|Keynote: Have no fear - DFIR is here!
||Rob Lee, Chad Tilbury, Alissa Torres, Phil Hagen, and Lenny Zeltser
||Wednesday, March 5th, 7:00pm - 8:30pm
||Saturday, March 8th, 12:30pm - 1:15pm
||Lunch and Learn