DFIRHub

GetScreen

GetScreen artifacts

  • Apps
  • 3 paths
  • regex:.*\.(gui\.)?logsession.inf
  • Per-user data
  • Version 1
  • Paul Cabon CERT Almond

Paths on disk

3 paths

Paths use Windows environment variable syntax

References

1 link