georgeneokq / artifact-exterminator

Simple, flexible command-line tool for conducting anti-forensics (for research purposes only)
0 stars 0 forks source link

ShimCache: Schedule task to clear Shimcache after computer restart #7

Closed georgeneokq closed 2 years ago

georgeneokq commented 2 years ago

Shimcache entries for the current lifetime of the system are stored in memory and can only be viewed in the registry upon next startup of the system. Hence, the Shimcache entries should only be wiped after system reboot.

To make this possible, our program should have a command line argument that specifies to run the shimcache removal function only. That argument can be used to run the shimcache removal function through a scheduled task. (Links to issue #6)

georgeneokq commented 2 years ago