{"version":1,"pages":[{"id":"-LbSIGOGsQ5ftjpJYMTF","title":"Introduction","pathname":"/computerforensics","siteSpaceId":"sitesp_UTFgo","description":""},{"id":"-LbWTefRh6Igk8ZmHSU_","title":"Acquisition Method","pathname":"/computerforensics/acquisition/acquisition","siteSpaceId":"sitesp_UTFgo","description":"Below list out a list of procedures to create computer images","breadcrumbs":[{"label":"Acquisition"}]},{"id":"-MRsWR2oTVMmXSX4Nisn","title":"Live Data Collection","pathname":"/computerforensics/acquisition/incident-response-method","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Acquisition"}]},{"id":"-LbWTefUfm3EfhBlh-0C","title":"Basic EnCase","pathname":"/computerforensics/encase/basic-encase","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"EnCase"}]},{"id":"-LbWTefVJcynG3RPrTvO","title":"Advanced EnCase","pathname":"/computerforensics/encase/advanced-encase","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"EnCase"}]},{"id":"-LbWTefWXO3MubFzcIdJ","title":"EnScript","pathname":"/computerforensics/encase/enscript","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"EnCase"}]},{"id":"-MDTpmUobKsDDp2epAh3","title":"Nuix Processing","pathname":"/computerforensics/nuix/nuix-processing","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Nuix"}]},{"id":"-MDTpmUpsFtskRzvIxDN","title":"Nuix General","pathname":"/computerforensics/nuix/nuix-general","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Nuix"}]},{"id":"-MDTpmUq5ePOkbrN4XnL","title":"Nuix Scripting","pathname":"/computerforensics/nuix/nuix-scripting","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Nuix"}]},{"id":"-LtwP529VXuC9io4tHsw","title":"Process","pathname":"/computerforensics/memory-analysis/process","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Memory Analysis"}]},{"id":"-Lti9ZOhMcEkuwH7KOF0","title":"Volatility","pathname":"/computerforensics/memory-analysis/volatility","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Memory Analysis"}]},{"id":"-LvK07HL74wYWHJNkNIy","title":"Volatility Plugin","pathname":"/computerforensics/memory-analysis/volatility-plugin","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Memory Analysis"}]},{"id":"-LvO3-TTvVWS9oa02FMX","title":"Analysis Keypoints","pathname":"/computerforensics/memory-analysis/analysis-steps","siteSpaceId":"sitesp_UTFgo","description":"Analysis steps for memory image","breadcrumbs":[{"label":"Memory Analysis"}]},{"id":"-Lu64a637n523gfSpdRw","title":"Registry","pathname":"/computerforensics/incident-response-artifacts/registry","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-MhN7ThUwQLDiwDCTLBx","title":"Recycle Bin","pathname":"/computerforensics/incident-response-artifacts/recycle-bin","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-MFOsosnAhh-vQ3Jn15s","title":"Master File Table (MFT)","pathname":"/computerforensics/incident-response-artifacts/master-file-table-mft","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-MFGxTiSL2-EXNLQcDaI","title":"LNK File","pathname":"/computerforensics/incident-response-artifacts/lnk-file","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-MFH48ncCgwj8gqTywC3","title":"AppCompatCache","pathname":"/computerforensics/incident-response-artifacts/appcompatcache","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-M56QsnL3yyfZML71C6d","title":"Volume Shadow Copy","pathname":"/computerforensics/incident-response-artifacts/volume-shadow-copy","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-M567Nn0oHirWCQfgvZs","title":"Windows Event Logs","pathname":"/computerforensics/incident-response-artifacts/windows-event-logs","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-MFGx_QfbLCK3iddyTVT","title":"Jump Lists","pathname":"/computerforensics/incident-response-artifacts/jump-lists","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-M561VEgO1XLndZ9GsL3","title":"Prefetch","pathname":"/computerforensics/incident-response-artifacts/prefetch","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-M563M8_fhoDH86p1mhR","title":"File system log","pathname":"/computerforensics/incident-response-artifacts/file-system-log","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-MW4K8gIVIjy6wMpKN5Y","title":"Browser","pathname":"/computerforensics/incident-response-artifacts/browser","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Incident Response Artifacts"}]},{"id":"-LuBln-e4Tl8cLODzseX","title":"Timeline","pathname":"/computerforensics/others/timeline","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Others"}]},{"id":"-M21dXbJSdfK9vrwJvBO","title":"Mounting an image","pathname":"/computerforensics/others/mounting-an-image-to-a-vm","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Others"}]},{"id":"-M8KK1cEHrksy0GLipZx","title":"NAS","pathname":"/computerforensics/others/nas","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Others"}]},{"id":"-MFACoXhYu4DF7Z7aPAu","title":"Samba","pathname":"/computerforensics/others/samba","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Others"}]},{"id":"-MRz_rs5w_uBjXc6jqtZ","title":"Docker","pathname":"/computerforensics/others/docker","siteSpaceId":"sitesp_UTFgo","description":"Some docker commands","breadcrumbs":[{"label":"Others"}]},{"id":"-MWdKvSAsfyuIKSbTVhz","title":"Cloud Artifacts","pathname":"/computerforensics/cloud/cloud-artifacts","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Cloud"}]},{"id":"-MQRYkutB870LwLYBj4P","title":"Azure Forensic","pathname":"/computerforensics/cloud/azure-forensic","siteSpaceId":"sitesp_UTFgo","description":"","breadcrumbs":[{"label":"Cloud"}]}]}