> For the complete documentation index, see [llms.txt](https://www.iblue.team/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.iblue.team/windows-forensics.md).

# Windows Forensics

- [PsExec](https://www.iblue.team/windows-forensics/psexec.md)
- [PsExec and NTUSER data](https://www.iblue.team/windows-forensics/psexec/psexec-and-ntuser-data.md): TL;DR - Using PsExec to deploy & execute a file in the context of a user results in the specified user's NTUSER data profile being created despite never interactively logging onto the system itself.
- [Security Patch/KB Install Date](https://www.iblue.team/windows-forensics/security-patch-kb-install-date.md): How to determine installation time of a specific security patch/update/KB package based on registry key values.