Repository navigation
Version 1.0
Using the Win32 API:
π₯οΈ System information (including timezone and runtime)
β° Scheduled tasks
π Open sessions
βοΈ Running processes
π€ User accounts
π§© Services
π Event logs (optional)
By parsing the registry:
π§ UserAssist
ποΈ MUICache
π΅οΈ Background Activity Monitor (BAM)
π USB devices
π§³ Shellbags
π MRU entries
π RUN keys analysis
π§± Shimcache
ποΈ Amcache
π§· Jumplists
By parsing disk files:
π Prefetch files
π Recent documents