> For the complete documentation index, see [llms.txt](https://notes.qazeer.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.qazeer.io/dfir/windows.md).

# Windows

- [Artefacts overview](https://notes.qazeer.io/dfir/windows/_artefacts_overview.md)
- [Amcache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/amcache.md)
- [EVTX](https://notes.qazeer.io/dfir/windows/_artefacts_overview/evtx.md)
- [Jumplist](https://notes.qazeer.io/dfir/windows/_artefacts_overview/jumplist.md)
- [LNKFile](https://notes.qazeer.io/dfir/windows/_artefacts_overview/lnkfile.md)
- [MFT](https://notes.qazeer.io/dfir/windows/_artefacts_overview/mft.md)
- [Outlook\_files](https://notes.qazeer.io/dfir/windows/_artefacts_overview/outlook_files.md)
- [Prefetch](https://notes.qazeer.io/dfir/windows/_artefacts_overview/prefetch.md)
- [RecentFilecache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/recentfilecache.md)
- [RecycleBin](https://notes.qazeer.io/dfir/windows/_artefacts_overview/recyclebin.md)
- [Shellbags](https://notes.qazeer.io/dfir/windows/_artefacts_overview/shellbags.md)
- [Shimcache](https://notes.qazeer.io/dfir/windows/_artefacts_overview/shimcache.md)
- [SRUM](https://notes.qazeer.io/dfir/windows/_artefacts_overview/srum.md)
- [Timestamps](https://notes.qazeer.io/dfir/windows/_artefacts_overview/timestamps.md)
- [User Access Logging (UAL)](https://notes.qazeer.io/dfir/windows/_artefacts_overview/user_access_logging.md)
- [UsnJrnl](https://notes.qazeer.io/dfir/windows/_artefacts_overview/usnjrnl.md)
- [Miscellaneous](https://notes.qazeer.io/dfir/windows/_artefacts_overview/misc.md)
- [TTPs analysis](https://notes.qazeer.io/dfir/windows/ttps_analysis.md)
- [Accounts usage](https://notes.qazeer.io/dfir/windows/ttps_analysis/accounts_usage.md)
- [Local persistence](https://notes.qazeer.io/dfir/windows/ttps_analysis/local_persistence.md)
- [Lateral movement](https://notes.qazeer.io/dfir/windows/ttps_analysis/lateral_movement.md)
- [PowerShell activity](https://notes.qazeer.io/dfir/windows/ttps_analysis/powershell_activity.md)
- [Program execution](https://notes.qazeer.io/dfir/windows/ttps_analysis/program_execution.md)
- [Timestomping](https://notes.qazeer.io/dfir/windows/ttps_analysis/timestomping.md)
- [EVTX integrity](https://notes.qazeer.io/dfir/windows/ttps_analysis/evtx_integrity.md)
- [System uptime](https://notes.qazeer.io/dfir/windows/ttps_analysis/system_uptime.md)
- [ActiveDirectory replication metadata](https://notes.qazeer.io/dfir/windows/ttps_analysis/activedirectory_replication_metadata.md)
- [ActiveDirectory persistence](https://notes.qazeer.io/dfir/windows/ttps_analysis/activedirectory_persistence.md)