Tag Info

New answers tagged

0

One possible solution would be to take a forensically sound image of the target (entire HDD or a specific area or even the RAM) before and after the program you are wanting to analyze runs. Then simply* compare the two images. I would start with comparing hashes just to be certain something did change (so you dont waste time 'looking'). Many times, ...



Top 50 recent answers are included