Windows Forensics

Artifacts

• Windows Registry
  • AmCache
  • ShellBags
  • Jumplists
  • Windows Shortcuts
  • WIndows USB Device Activity
  • Most Recently Used Lists
  • ShimCache
  • UserAssist Registry Key
  • Background Activity Monitor
  • Desktop Activity Monitor
• Page File
• Hibernation File
• Windows Transaction Logs
• NTFS
  • MFT
• Windows Prefetch Files
• Windows Event Viewer
• Windows Recent Activity
• Windows Internet Explorer History
• Windows Search Database
• Windows AutoRuns

Techniques

• PowerShell Script Block Logging

Tools

• SRUM
• Windows Event Viewer
• Windows Task Scheduler