Tag Info

New answers tagged


One possible solution would be to take a forensically sound image of the target (entire HDD or a specific area or even the RAM) before and after the program you are wanting to analyze runs. Then simply* compare the two images. I would start with comparing hashes just to be certain something did change (so you dont waste time 'looking'). Many times, ...

Top 50 recent answers are included