Articles Evidence Collection OSFClone WinFE based on WinPE for Windows 10 Timeline Analysis plaso Timeline analysis using ElasticSearch/Kibana/plaso on SIFT Visualize timeline using ElasticSearch/Kibana/plaso on SIFT Misc SDelete Deleted Shadow Copies