Skip to content
WMIparser

Posts tagged: #objects-data

← Back to all posts
SCCM RecentlyUsedApps: evidence of execution in WMI
Read CCM_RecentlyUsedApps from the WMI repository: which programs each user ran, when last and how often, including older copies carved from OBJECTS.DATA.
wmisccmevidence-of-executionobjects-data
Recovering Deleted WMI Persistence From OBJECTS.DATA
Why deleted WMI filters, consumers and bindings survive in OBJECTS.DATA, how index walking and carving differ, and how python-cim and PyWMIPersistenceFinder compare.
wmicarvingobjects-datapersistence
Inside OBJECTS.DATA: WMI Repository Forensics
How the WMI CIM repository stores objects: OBJECTS.DATA pages, INDEX.BTR keys, the three MAPPING files, class definitions, instances and name hashes.
wmicim-repositoryobjects-datadfir