shimcache

Here is 1 public repository matching this topic...

KrishnenduOfficial / winforensics-correlator

A fast, cross-artifact Windows forensic timeline correlator in Python. Automatically stitches fragmented telemetry from MFT, SRUM, Shimcache, and BAM to spot timestomping, ghost execution, and account-level activity in one unified timeline.

incident-response dfir threat-hunting digital-forensics timeline-analysis srum windows-forensics shimcache timestomping

Updated Sep 19, 2026
Python

Add this topic to your repo

To associate your repository with the shimcache topic, visit your repo's landing page and select "manage topics."

Learn more