Windows 10 DFIR Challenges | Andrew Case
Summary: Andrew Case of Volexity gave a September 2019 Cyber Sessions talk on Windows 10 features that change what evidence digital forensic and incident response investigators can find on disk and in memory. The features cited include new event logging sources, new artifacts of program execution and file access, compression of in-memory data stores, and native support for Linux virtual machines.
What you should know: Windows 7 reached official end-of-life in January 2020, and the source states that blue and red team workflows must both be updated to account for Windows 10's logging and in-memory changes.
Read the original at Volexity Blog ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026