During a malware investigation at a tech firm in Miami, forensic analysts suspect that the attacker attempted to conceal activity by removing traces of previously executed programs on the compromised workstation. What source of evidence would best allow investigators to reconstruct execution activity and attempts to remove traces of prior programs?
Submit