Crashes (WER)

File Location:

• C:\Programdata\Microsoft\Windows\WER

• C:\Users\USERNAME\Appdata\Local\Microsoft\Windows\WER

  • Check default, public, and all user profiles for crash reports.

Parse Data

Considerations

Anti-Forensics