WER
Windows Error Reporting
- 5 paths
*.dmp- Per-user data
- Version 1.1
- Troy Larson
Paths on disk
5 paths
References
6 links
- isc.sans.edu/forums/diary/Windows+Error+Reporting+DFIR+Benefits+and+Privacy+Concerns/22536/(opens in new tab)
- medium.com/dfir-dudes/amcache-is-not-alone-using-wer-files-to-hunt-evil-86bdfdb216d7(opens in new tab)
- nasbench.medium.com/windows-forensics-analysis-windows-artifacts-part-i-c7ad81ada16c(opens in new tab)
- sans.org/reading-room/whitepapers/forensics/windows-crash-dumps-remote-incident-identification-36012(opens in new tab)
- journeyintoir.blogspot.com/2014/02/exploring-windows-error-reporting.html(opens in new tab)
- secjuice.com/windows-forensics-artifacts-2/(opens in new tab)