Windows Forensics¶
Host-based artifacts on Windows — where they live, what they prove, how to parse them. Start from the question you need to answer, then open the artifact pages.
Artifact map — by question¶
| Question | Primary artifacts | Also check |
|---|---|---|
| Did this program run? When? How often? | Prefetch · BAM/DAM (Registry) · Security 4688 / Sysmon 1 (Event logs) |
Shimcache (existence + order), Amcache, UserAssist, SRUM (hourly, with user) |
| What was that binary? (renamed / deleted) | Amcache — SHA-1 | Prefetch file references, $MFT resident data, MUICache |
| Which user ran it? | BAM/DAM, UserAssist, SRUM, 4688 SubjectUserName |
LNK / Jump Lists under that profile |
| Which files/folders did the user open? | LNK / Jump Lists · RecentDocs, OpenSavePidlMRU, Office MRU (Registry) | ShellBags (folders), Office Trusted Documents (macro docs) |
| What happened to a file — created, renamed, deleted, stomped? | $UsnJrnl + $MFT | $LogFile, $I30 slack, Sysmon 11, 4663 |
| Where did the file come from? | Zone.Identifier ADS in $MFT (URL) |
Browser history, LNK volume serial (USB), 5145 share access |
| Was a USB device plugged in? Which one? Who used it? | USBSTOR, MountedDevices, MountPoints2 (Registry) |
setupapi.dev.log, Partition/Diagnostic 1006, LNK to E:\ |
| Did data leave the machine? How much? | SRUM Network Usage — bytes per app per hour | $UsnJrnl archive creation, Sysmon 3, proxy/firewall/Zeek |
| How did they get in / move laterally? | 4624 type 3/10, 4648, 4778, RDP 21/25/1149, 7045, 5140/5145 (Event IDs) |
WinRM / WMI-Activity channels, Prefetch for psexesvc, wsmprovhost |
| How do they persist? | Run keys, Services, Scheduled tasks, WMI, COM hijack (Registry ASEP) | 7045, 4698, WMI 5861, Startup folders, Autoruns offline |
| Was logging tampered with? | 1102, 104, 4719, record-ID gaps (Event logs) |
Oldest event per channel, $UsnJrnl vs. empty logs, VSS copies |
| What's the system, timezone, users, network? | CurrentVersion, TimeZoneInformation, ProfileList, NetworkList, SAM (Registry) |
setupapi, DHCP lease in Tcpip\Parameters |
Artifact pages¶
- Prefetch — execution, last 8 run times, files touched
- Amcache — SHA-1 of every binary seen
- Shimcache — existence & order; works on servers
- Registry keys — identity, user activity, USB, persistence
- LNK & Jump Lists — files/folders opened, USB serials
- $MFT / $UsnJrnl / $LogFile — file system history, timestomping
- SRUM — bytes sent per app per hour, with user
- Event logs — channels, retention, parsing, tampering
- Identifying artefacts by scenario — normal vs suspicious, what context to ask, which artefact next
Collection order (when time is short)¶
- Memory (if the box is live and you can) — then everything else.
$MFT,$UsnJrnl:$J,$LogFile— cheap, huge payoff.- Registry hives + transaction logs (
SYSTEM,SOFTWARE,SAM,SECURITY, everyNTUSER.DAT+UsrClass.dat),Amcache.hve. C:\Windows\System32\winevt\Logs\*.evtx.C:\Windows\Prefetch\,C:\Windows\System32\sru\, users'Recent\(LNK + Jump Lists), PowerShellConsoleHost_history.txt.- Browser data,
Tasks\,Startupfolders,Tempdirectories,setupapi.dev.log.
KAPE's !SANS_Triage compound target covers all of the above in a few minutes; Velociraptor's Windows.KapeFiles.Targets does the same remotely.
Adding a page here
python new.py windows/<name> -t artifact — or just drop a .md file in docs/windows/. It appears in the sidebar automatically.