Skip to content

Latest commit

 

History

History
11 lines (6 loc) · 542 Bytes

README.md

File metadata and controls

11 lines (6 loc) · 542 Bytes

PCAParser

A PowerShell 5 script that can be used to parse and convert to CSV the new Windows 11 artifacts found in C:\Windows\appcompat\pca

Documentation

Check out the blog post on AboutDFIR highlighting this new artifact here.

Sample Data

Sample artifacts to test this script on can be found in the DFIRArtifactMuseum, specifically here.