Posts tagged: #acquisition

Where the WMI repository lives and how to copy OBJECTS.DATA, INDEX.BTR and the MAPPING files safely: shadow copy, KAPE WBEM target, Velociraptor or an image.