AmCache Investigation - SANS Digital Forensics & Incident Response Summit 2019

[@johnymanuel4419]

Thank you! Documented Very well and the scenarios helped understand each values usage

[@callancasen9695]

instablaster

[@marcus.edmondson]

Here’s a blog post I wrote on how to collect amcache remotely and analyze it with PowerShell and Python.
marcusedmondson.com/2018/02/10/powershell-python-awesome-amcache-collection-analysis/