Posts tagged: #acquisition

Where the Windows notification database lives on Windows 10 and 11, and how to collect it with its -wal file from live systems, images, KAPE or Velociraptor.