Windows Collections Detail

windows collections detail index

Below are all Windows collector pages:

• Windows Evidence Documentation

• Amcache

• Antivirus Information

• AppPaths

• AppCompatCache

• ARP Table

• Artifacts

• $Boot

• Browser Extensions

• Chrome Bookmarks

• Chrome Browsing History

• Chrome Cookies

• Chrome Downloads

• Chrome Extensions

• Chrome Favicons

• Chrome Form History

• Chrome Local Storage

• Chrome Login Data

• Chrome Sessions

• Chrome Thumbnails

• Chrome User Profiles

• Chrome Web Storage

• CIDSizeMRU

• Clipboard

• CLR Logs

• Crash Dump Information

• Default Browser

• DNS Cache

• DNS Servers

• Docker Changes

• Docker Container Logs

• Docker Containers

• Docker Image History

• Docker Images

• Docker Info

• Docker Logs

• Docker Networks

• Docker Tops

• Docker Volumes

• Downloaded Files Information

• Driver Objects

• Drivers List

• Edge Bookmarks

• Edge Browsing History

• Edge Cookies

• Edge Downloads

• Edge Extensions

• Edge Favicons

• Edge Form History

• IE 10-11 & Edge Browsing History

• Edge Local Storage

• Edge Login Data

• Edge Sessions

• Edge Thumbnails

• Edge User Profiles

• Edge Web Storage

• Environment Variables

• ETL Logs

• Event Logs

• EventTranscript DB

• FileExts

• Firefox Browsing History

• Firefox Cookies

• Firefox Downloads

• Firefox Extensions

• Firewall Rules

• FirstFolder

• Hibernation File

• Hosts File

• Iconcache

• IE 7-8-9 Browsing History

• Windows Index Search

• INF Setup Logs

• Installed Applications

• IPv4 Routes

• Jumplist

• LastVisitedPidlMRU

• Lnk Files

• $LogFile

• Map Network Drive MRU

• Master Boot Record (MBR)

• MFT (Binary)

• MFT Mirror

• MFT as CSV

• Network Adapters

• Network Capture

• Network Shares

• NTDS.dit

• Object Directory

• OfficeMRU

• Old Registry Hives

• OpenSavePidlMRU

• Page File

• PDB Information

• Registry Persistence

• Scheduled Tasks

• Service List

• Startup Items

• Powershell History

• PowerShell Logs

• Prefetch Files

• Processes and Modules

• Proxy Information

• Quick Assist

• RAM Image

• RDP Cache Files

• RecentDocs

• RecentFileCache.bcf

• Recycle Bin Information

• Registry Items

• Registry Hives

• System Restore Points Information

• RunMRU

• Sam

• Window Screenshots

• $Secure:$SDS

• Shadow Copy as CSV

• ShellFolders

• ShellBags

• Shim Database

• SRUM

• Superfetch

• Swap File

• TCP Table

• Thumbcache

• Timeline

• $TxfLog $Tops:$T

• TypedPaths

• TypedURLs

• Ual

• UDP Table

• USB Storage History

• User Folders

• UserAssist

• Users

• USN Journal (Binary)

• USN Journal $Max

• USN Journal as CSV

• Volume Information

• WBEM Files

• Winrar

• Wireless History

• Active Script Event Consumers

• Command Line Event Consumers

• WordWheelQuery