Hi All,
Just need some advice around actually finding let’s say a particular program on a media and associated file extensions if they exist or existed on a system. For instance, let’s say MS Word was/is installed on a system or it could be any software for that matter, even if the program was deleted. How could you detect it? What ingest modules or options can do this? Is there an option to define new types of signature analysis for new programs/extensions even when deleted?
Please advise?