User contributions
- 12:02, 9 April 2012 (diff | hist) . . (+94) . . m FAT (→Specification)
- 11:31, 9 April 2012 (diff | hist) . . (-78) . . m FAT (→FAT16: Nr of clusters was ambiguous -- clarified max to be as per fatgen103.doc, p. 15)
- 11:29, 9 April 2012 (diff | hist) . . (0) . . m FAT (→FAT12: Adjusted max nr of clusters to correspond with statement in fatgen103 document, p. 15.)
- 11:10, 9 April 2012 (diff | hist) . . (+208) . . m FAT (Added section 'Specification', moved the 'See also' info there, and extended information with known de jure standards.)
- 07:41, 26 March 2012 (diff | hist) . . (+37) . . m Determining OS version from an evidence image (→Windows 95/98/ME)
- 07:38, 26 March 2012 (diff | hist) . . (+1) . . Determining OS version from an evidence image (→Windows 95/98/ME)
- 07:36, 26 March 2012 (diff | hist) . . (+39) . . m Determining OS version from an evidence image (→Windows 95/98/ME)
- 05:00, 26 March 2012 (diff | hist) . . (+14) . . Determining OS version from an evidence image (→Windows 95/98/ME)
- 04:55, 26 March 2012 (diff | hist) . . (+138) . . Determining OS version from an evidence image (→Windows 95/98/ME)
- 04:51, 26 March 2012 (diff | hist) . . (+145) . . Determining OS version from an evidence image (→Windows 95/98/ME)
- 04:43, 26 March 2012 (diff | hist) . . (+70) . . Determining OS version from an evidence image (→Windows 95/98/ME)
- 04:11, 26 March 2012 (diff | hist) . . (+7) . . Determining OS version from an evidence image (→Windows 95/98/ME)
- 04:10, 26 March 2012 (diff | hist) . . (+258) . . m Determining OS version from an evidence image (→Windows 95/98/ME: Added one point of identification)
- 05:37, 20 January 2012 (diff | hist) . . (+5) . . Windows Prefetch File Format (→Section D)
- 05:34, 20 January 2012 (diff | hist) . . (+1) . . Windows Prefetch File Format (→Section D)
- 05:28, 20 January 2012 (diff | hist) . . (+36) . . Windows Prefetch File Format (→Section D)
- 05:06, 20 January 2012 (diff | hist) . . (+441) . . Windows Prefetch File Format (→Section D)
- 07:19, 19 January 2012 (diff | hist) . . (+102) . . Windows Prefetch File Format (→Section D)
- 05:21, 19 January 2012 (diff | hist) . . (-6) . . m Tools:Data Recovery (→Carving: Modified link to and naming of RevIt / ReviveIt to fit current state)
- 12:07, 14 December 2011 (diff | hist) . . (+650) . . Talk:Timestomp
- 03:07, 16 September 2011 (diff | hist) . . (+11) . . Windows Prefetch File Format (→Section D)
- 03:04, 16 September 2011 (diff | hist) . . (+568) . . Windows Prefetch File Format (→Section D)
- 02:58, 16 September 2011 (diff | hist) . . (-59) . . Windows Prefetch File Format (→Section D)
- 02:54, 16 September 2011 (diff | hist) . . (+373) . . Windows Prefetch File Format (→Section D)
- 02:50, 16 September 2011 (diff | hist) . . (+91) . . Windows Prefetch File Format (→Section D)
- 10:29, 14 September 2011 (diff | hist) . . (+45) . . Windows Prefetch File Format (→Header)
- 10:24, 14 September 2011 (diff | hist) . . (-23) . . Windows Prefetch File Format (→Header)
- 10:22, 14 September 2011 (diff | hist) . . (-5) . . Windows Prefetch File Format (→Section A and B)
- 10:20, 14 September 2011 (diff | hist) . . (-5) . . Windows Prefetch File Format (→Header format)
- 10:16, 14 September 2011 (diff | hist) . . (0) . . Windows Prefetch File Format (→Header format)
- 10:12, 14 September 2011 (diff | hist) . . (+992) . . Windows Prefetch File Format (→Header format)
- 10:03, 14 September 2011 (diff | hist) . . (-19) . . Windows Prefetch File Format (→Header)
- 10:02, 14 September 2011 (diff | hist) . . (+14) . . Windows Prefetch File Format (→Header format)
- 10:00, 14 September 2011 (diff | hist) . . (+78) . . Windows Prefetch File Format (→Header format)
- 09:58, 14 September 2011 (diff | hist) . . (+46) . . Windows Prefetch File Format (→Header format 17)
- 09:57, 14 September 2011 (diff | hist) . . (+861) . . Windows Prefetch File Format (→Header)
- 09:35, 14 September 2011 (diff | hist) . . (+52) . . Windows Prefetch File Format (→Section A and B)
- 09:34, 14 September 2011 (diff | hist) . . (+399) . . N Windows Prefetch File Format (Created page with "A Windows Prefetch file consists of one file header and multiple file sections with different content. Not all content has an obvious forensic value. As far as have been possibl...")
- 09:31, 14 September 2011 (diff | hist) . . (+27) . . User talk:Athulin (→Work in progress) (top)
- 09:19, 14 September 2011 (diff | hist) . . (+102) . . User talk:Athulin
- 09:17, 14 September 2011 (diff | hist) . . (+31) . . N User talk:Athulin (test)
- 09:05, 14 September 2011 (diff | hist) . . (+98) . . m File Systems (→CD and DVD File Systems: DVD-RAM was lumped together with WO-media, but should be recognized as an exception)
- 03:17, 14 September 2011 (diff | hist) . . (-29) . . m Prefetch (Fairly obvious from live machines that executable name is not restricted to 8 characters -- parenthesis removed)
- 04:55, 29 October 2007 (diff | hist) . . (+200) . . Full Disk Encryption (Added links to Hitachi & PointSec)
- 04:41, 29 October 2007 (diff | hist) . . (+426) . . N Talk:Tools:File Analysis (Are file hash analysis tools suitable for this page?)
