This week I continue the back to basics series with talk on the Windows Shimcache.

This week it's a refresher on the Windows Prefetch, a core Microsoft artifact every examiner should know.

This week I kick off a revisit of the fundamentals helpful to all new examiners.

This week I go over some "go to" Windows Event Logs.

This week I talk about Mac Logs, namely the new Unified Logging in OS X and how this impacts forensic exams.

This week I talk about the "built-in" eDiscovery tools for Office 365

This week I break down the different variations of the "malware analyst." Do you qualify as one?

This week I talk about the volatility plug-ins for autopsy that allow you to do memory forensics in the autopsy forensic console.

This week I talk about the new file system released by Apple, APFS, and what it means for forensic examiners.

This week I talk about RTFM, the companion to the blue team field manual that's filled with over 1000 commands for windows and Linux.