Skip to content
WMIparser

Posts tagged: #cim-repository

← Back to all posts
Inside OBJECTS.DATA: WMI Repository Forensics
How the WMI CIM repository stores objects: OBJECTS.DATA pages, INDEX.BTR keys, the three MAPPING files, class definitions, instances and name hashes.
wmicim-repositoryobjects-datadfir