Artefacts overview
Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: artefacts.help.
General
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| General | Overall system usage: Accounts authentication successes and failures, local accounts and groups management, Windows Services or scheduled tasks operations, PowerShell activity, etc. Various events of forensic interest across multiple providers are referenced in the present overview. |
| Default location for | Tools for analyzing |
Registry hives | General | Registry hives are system-wide or per users hierarchical databases used by the Windows operating system, and third-party applications, to store information.
A registry hive is a group of keys, subkeys, and values in the registry, with supporting file(s) on disk. Registry hives are loaded in memory upon system boot or user logon from their associated files on disk.
Before being written / committed to a file on disk, registry modifications can be written to | The system-wide registry hives are stored in the | - |
|
System information
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| System information | Name of the computer. | - | File: | |
| System information | Version and Service pack number of the Windows operting system. | - | File: | |
| System information | Basic information on the system:
- Computer name and | Registry keys under | File: | |
| System information | Time zone information. | - | File: | |
| System information |
| - | File: | |
| System information | Basic information about network interfaces (interface name, associated IP address, default gateway, and DHCP lease and eventual domain).
Additional network information is available in the | - | File: | |
| System information | Network SMB shares hosted by the system. | Each network share is associated with a | File: | |
| System information | Windows local Firewall profiles (Public, Private, and Domain) status and configured rules. | - | File: | |
| System information | Applications installed on the system, on a system-wide or per user basis.
The entries are mainly used by the Windows operating system for two purposes:
- Mapping an application file name to its executable full path.
- Pre-pending information to the | Applications installed system-wide have their information written in the | For system-wide applications:
File:
| |
| System information | Applications installed on the system, on a system-wide or per user basis, as displayed in the "Add or remove programs" of the Windows Control Panel / Settings. | Applications installed system-wide have their information written in the | For system-wide applications:
File:
| |
| System information | Windows services installed on the system. For more information: local persistence note. | Each service configuration is defined in a dedicated subkey under | File: | |
| System information | Scheduled tasks configured on the system as stored in the registry. For more information: local persistence note. | Each scheduled task configuration is defined in a dedicated subkey under | File: | |
Configured scheduled tasks ( | System information | Scheduled tasks configured on the system, as stored in tasks | Each scheduled task configuration is defined in a |
|
Filesystem
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Filesystem | The | Each file on an |
|
|
| Filesystem | The | Each file or folder is referenced in the |
| |
| Filesystem | The | Each |
|
|
| Filesystem | The | As low-level operations are journalized, the |
| |
| Filesystem | The | The records in the |
|
|
| Filesystem | The | By default, only items from the following sources are scanned and indexed:
- Files and folders from the Users folders.
> Data available: file name, path, size, attributes, | Windows XP:
| |
| Filesystem (Deleted files) | Deleted files and folders (if deleted through a recycle bin aware application). | The deleted files are placed in a subfolder (under |
|
Program execution
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Programs execution | For more information: Program execution note. | Event |
| |
| Programs execution (before Windows 10 / Windows Server 2016) Executable presence | Application compatibility feature that aim to maintain support of existing software to new versions of the Windows operating system.
A | Each | File: |
|
| Programs execution (for non up-to date system) Executable presence | Very complex artefact, linked to an application compatibility feature that aim to maintain support of existing software to new versions of the Windows operating system (like the | The |
|
|
| Programs execution (GUI programs only) | The | The information stored by the | Files under | |
| Programs execution |
| The |
|
|
| Programs execution |
| Related to program execution, the |
|
|
Windows 10 Timeline / | Programs execution | The Windows Activity history tracks a number of operations on the system: programs used, local files opened, SharePoint documents consulted, and websites browsed (using Internet Explorer / Microsoft Edge Legacy). The Activity history can be consulted in the Windows Timeline (Windows + Tab keys).
The | The |
| |
| Programs execution (GUI programs only) | The purpose of the | One or two main registry subkeys can be found depending on the Windows OS version:
- On Windows Xp, | File: | |
| Programs execution (GUI programs only) |
| Each execution is associated with two values under the | File:
| |
| Programs execution |
| The | File: | |
| Programs execution | Feature linked to the Windows Task, storing a number of metrics related to the Task bar usage. | Each operation (detailed below) is associated with an entry composed of the program full path and operation run count. No timestamp of execution is available.
Subregistry keys:
- | File: | |
| Programs execution and PowerShell activity | For more information: PowerShell activity note. |
|
| |
PowerShell console activity | Programs execution and PowerShell activity | Starting with | The |
| |
.NET CLR | Programs execution | Following the execution (or in-memory injection) of a .NET assembly, the | The filename of the log file match the name of the assembly / binary executed. The file creation timestamp corresponds to the first time the associated assembly was executed and the file last modification timestamp corresponds to the last execution time of the assembly. |
| |
| Programs execution | Undocumented feature, added and (relatively) shortly after removed from the Windows operating system. | Each subkey, identified with a GUID, under the | File: | |
| Programs execution | Detailed in | - | - | |
| Programs execution | Recently executed programs, linked to | The key contains an ordered | File: | |
| Programs execution | Records the programs used to open / save (some of) the file tracked in the | Applications tracked are stored in an ordered | File: | |
| Programs execution | Tacks items (program, files / folders, | Each entry successfully launched trough the | File: |
Files and folders access
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Folders access | Registry keys designed as an user experience enhancing feature to keep track of Windows explorer graphical display settings on a folder-by-folder basis. For instance, a | Various kinds of user activity may generate or update | Locations starting from Windows 7:
|
|
| Files and folders access | Linked to a taskbar user experience-enhancing feature that allows users to "jump" to files, folders or others elements by right clicking on open applications in the | An application is associated with one |
| |
| Files and folders access | Windows Shell Items that reference an original file, folder, or application.
While | The creation and modification timestamps of the shortcut file itself will usually respectively indicate when the target file was first and last opened.
Each shortcut file additionally yield the following information:
- The target file's absolute path, size and attributes (hidden, read-only, etc.).
- The target file modified, access, and created ( | Automatically created |
|
Windows 10 Timeline / | Files and folders access | Detailed in | - | - | |
| Files and folders access | Access to local files may appear in the | Access to local files will be identifiable by the |
| |
| Files and folders access | Information on files opened or saved through the "Open File" or "Save File" | The | File: | |
| Files and folders access | Non-executable files opened through the Windows Explorer, stored as one subkey per file extension. | Each subkey contains the opened files of the given extension stored in a ordered | File: | |
| Files and folders access | Paths entered (typed, pasted, or auto-completed) in the Windows Explorer location search bars. Entries are not added / updated in real-time, but are seemingly added / updated on user logoff / system reboot. | The file paths are stored as | File: | |
| Files and folders access | Keywords searched in from the | The entries are stored in a | File: | |
| Files and folders access | Detailed in | - | - | |
| Files and folders access | Detailed in | - | - | |
| Files and folders access | Detailed in | - | - | |
| Files and folders access | Currently or previously mapped drives (such as the system drive, USB devices, or network shares) mounted by the associated user. | Each drives is represented by a subkey, which is named as either the | File: | |
| Files and folders access | Recently used network shares. | - | File: | |
| Network shared files and folders access | Events related to network shares: creation, deletion, modification, and access attempts of network shares. Do not track access to folders and files hosted on network shares.
As there are no | Event |
| |
| Network shared files and folders access | Event related to access to folders and files hosted on network shares. The event is generated upon every access to a network shared file or folder. Failure events are generated only when access is denied at the file share level. The event may thus not indicate that the access to the shared folder or file was successful. | Event |
|
Remote Access / Lateral movements
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
Authentication
-
| Remote Access / Lateral movements | For more information: accounts usage note. | Event |
| |
Authentication
-
| Remote Access / Lateral movements | For more information: accounts usage note. | Only logged whenever alternate credentials are used:
Event |
| |
Authentication
-
| Remote Access / Lateral movements | For authentication attempts from a source host to a Active Directory domain-joined destination host (which is not the Domain Controller). For more information: accounts usage note. | For |
| |
Authentication
-
| Remote Access / Lateral movements | Feature that consolidates data on client activity.
On Domain Controllers, yield information on sessions opening on domain-joined computers (if the given DC was reached for authentication / | The information is stored locally in up to five | Database files ( | |
Remote Desktop
-
| Remote Access / Lateral movements | For more information: lateral movement note. |
|
| |
Remote Desktop
-
| Remote Access / Lateral movements |
| The last write timestamp of each key indicates was the associated user last logged on the system. | File: | |
Remote Desktop
-
| Remote Access / Lateral movements | For more information: lateral movement note. |
|
| |
Remote Desktop
-
| Remote Access / Lateral movements | - | Each remote host the user connected to (from the local system) is referenced as a dedicated subkey under | File: | |
Remote Desktop
-
| Remote Access / Lateral movements | Partial captures of the remote desktop screen from the Remote Desktop Client for RDP sessions. Implemented to reduce the amount of data sent by the server to save bandwidth usage. Bitmap caching be deactivated client-side in the Remote Desktop Client. | - | Windows XP / Windows Server 2003:
| |
Windows services
-
| Remote Access / Lateral movements | For more information: local persistence note. |
|
| |
Windows scheduled tasks
-
| Remote Access / Lateral movements | For more information: local persistence note. |
|
| |
PowerShell remoting ( | Remote Access / Lateral movements | For more information: PowerShell activity note. |
|
| |
PowerShell remoting ( | Remote Access / Lateral movements | The PowerShell host process ( | - | ||
PowerShell remoting ( | Remote Access / Lateral movements | For more information: PowerShell activity note. |
|
| |
| Remote Access / Lateral movements | The | - | ||
| Remote Access / Lateral movements |
| Contains information about users successful and unsuccessful authentication attempts (with the associated IP source). |
| |
Port forwarding
-
| Remote Access / Lateral movements |
| - | File: |
Network usage
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Network usage | Detailed in | The |
|
|
| Network usage | Basic network historical information (network name and type, first and last connection, etc.) | - | File: |
Local persistence
For artefacts on local persistence and AutoStart Extensibility Point (ASEP)
, refer to:
Web browsers usage
The web browsers related artefacts can be split in the following categories:
User profile: web browsers, such as
Chronium
-based browsers andFirefox
, implement a profile feature to store user's setttings, history, favourites, etc. The databases and files that store these information are usually stored under a user specific profile folder.History: web browsing history and download history.
Cookies: web browsing cookies (session tokens).
Cache: cache of resources downloaded from accessed websites (images, text content,
HTML
,CSS
,Javascript
files, etc.).Sessions: tabs and windows from a browsing session.
Settings: configuration settings.
These files are often stored under %LocalAppData%
(%SystemDrive%:\Users\<USERNAME>\AppData\Local\
) and %AppData%
(%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\
).
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Web browsers usage |
| The | File: | |
| Web browsers usage |
| - | History, downloads, cache, and cookies metadata in a | |
| Web browsers usage |
| - | User profile(s):
| |
| Web browsers usage |
| - | User profile(s):
| |
| Web browsers usage |
| - | User profile(s):
| |
| Web browsers usage |
| - | User profile(s):
|
Devices and USB activity
Windows devices terminology:
The
vendor ID
identifies a specific vendor, with a mapping available on devicehunt.com. Theproduct ID (PID)
identifies a product from that vendor.The
device ID
orhardware ID
is "a vendor-defined identification string that Windows uses to match a device to a driver package". The identifier references the vendor and product names as well as the revision version. Example for aDataTraveler_3
USB key by Kingston:Ven_Kingston&Prod_DataTraveler_3.0&Rev_PMAP
.The
instance ID
is "a device identification string that distinguishes a device from other devices of the same type on a computer". It contains the deviceserial number
, if supplied, and otherwise "some kind of location information". Example of aninstance ID
for a device that does not supply a serial number:5&2eab04ab&0&1
.The
device instance ID
is "a system-supplied device identification string that uniquely identifies a device in the system". It is notably composed of the device'sdevice ID
andinstance ID
.The
container ID
is "a system-supplied device identification string that uniquely groups the functional devices associated with a single-function or multifunction device installed in the computer". Starting with Windows 7, thePlug and Play (PnP) manager
uses thecontainer ID
to group one or more device nodes (devnodes
) that originated from a particular physical device.The
device interface class
represents the type of the device (storage devices, USB devices, Bluetooth devices, etc.). Eachdevice interface class
is associated with a uniqueGUID
, defined by Microsoft. The list ofGUIDs
by category of device can be found in the Microsoft documentation.External physical storage
GUID
:{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
.Logical volumes
GUID
:{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
.
Devices and USB activity forensics artefacts
The information below originates from tests on Windows 10 Pro - 19045.2965
and Windows 11 Pro - build 22621.1702
systems.
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Devices and USB activity | Contains system-wide information about the currently or previously connected USB devices. | Each USB devices is associated with a dedicated subkey under the | File: | |
| Devices and USB activity | Contains system-wide information about the currently or previously connected USB devices that are related to storage. | Each USB devices is associated with a dedicated subkey under the | File: | |
| Devices and USB activity | Contains system-wide information about the currently or previously . | Each devices is associated with a dedicated subkey under the | File: | |
| Devices and USB activity | The persistent database of the | Each devices is associated with a separate binary value, composed of:
- The device | File: | |
| Devices and USB activity | Contains system-wide information about the currently or previously connected plug and play devices (such as storage devices, volumes, network devices, Bluetooth devices, etc.). | Contains subkeys for each | File: | |
| Devices and USB activity | Contains information on currently or previously attached media and storage devices, notably the device volume(s)'s "friendly name" or display name. | Each devices is associated with a dedicated subkey under the | File: | |
| Devices and USB activity | Contains information on currently or previously mounted volumes, notably a mapping between drive letters and the last associated volume(s)'s "friendly name" or display name. | Each previously referenced drive letter ( | File: | |
| Devices and USB activity | Related to the ReadyBoost feature. | Each USB devices is associated with a dedicated subkey under the | File: | |
| Devices and USB activity | Currently or previously mapped drives (such as the system drive, USB devices, or network shares) mounted by the associated user. | Each drives is represented by a subkey, which is named as either the | File: | |
| Devices and USB activity | Plaintext log files that track installation of devices and drivers. The logs are rotated and preserved, so historical data dating back to the system install should be available (if the logs were not deleted / tampered). | Device installation entries (generated when the device is plugged-in) contain various information, including the device:
- | Windows XP: | |
| Devices and USB activity | Provider: | Event |
| |
| Devices and USB activity | Provider: | Event |
| |
| Devices and USB activity | Provider: | Event |
| |
| Devices and USB activity | Provider: | Event |
| |
| Devices and USB activity | Provider: | Event |
|
Anti-vius and Remote Administration/Access applications
The ruler-project
references numerous anti-virus products (20+) and remote administration/access applications (15+) artifacts.
Other third-party applications
The SANS institute "Windows Third-Party Apps Forensics" poster can be consulted for a list of artefacts from a number of popular Windows third-party applications (also including anti-vius and remote administration/access applications).
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Interaction with Azure though the | Folder |
|
Defense evasion
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Defense evasion | Generated upon the deletion of events in the | Event |
| |
| Defense evasion | Generated upon the deletion of events from event logs files (other than | Event |
|
Others
Name | Type | Description | Information / interpretation | Location | Tool(s) |
---|---|---|---|---|---|
| Thumbnail previews of files | The | The |
| |
| Windows Push Notifications | The Windows Push Notification service allows applications to deliver / push notifications, in three differents forms:
- | Each notification is associated with a dedicated entry in the | Per user database and | |
| Phishing / malware execution |
| Upon the mounting of an |
| |
| AD post exploitation | Active Directory | Upon execution of the |
| |
| AD post exploitation | Active Directory | Upon replication operations, such as the retrieval of Active Directory secrets ( |
|
TODO
IconCache.db
Hidden local account HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Bitsadmin
EVTX: Microsoft-Windows-Bits-Client%4Operational.evtx 59
Persistent files: %SystemRoot%\ProgramData\Microsoft\Network\Downloader\ https://www.sans.org/white-papers/39195/
Syscache hive
Small memory dumps: hiberfil.sys, pagefile.sys, swapfile.sys
Registry LOG Files
References
https://nasbench.medium.com/a-primer-on-event-tracing-for-windows-etw-997725c082bf
https://blog.1234n6.com/2018/10/available-artifacts-evidence-of.html
SANS posters Windows forensics - https://www.sans.org/posters/windows-forensic-analysis/
https://www.scitepress.org/papers/2017/64167/64167.pdf
http://windowsir.blogspot.com/2013/07/howto-determine-program-execution.html
https://www.sans.org/blog/opensavemru-and-lastvisitedmru/
https://andreafortuna.org/2018/05/23/forensic-artifacts-evidences-of-program-execution-on-windows-systems/
https://dfir.ru/2020/04/08/bam-internals/
https://cellebrite.com/en/analyzing-program-execution-windows-artifacts/
https://blog.1234n6.com/2018/10/available-artifacts-evidence-of.html
https://crucialsecurity.wordpress.com/2011/03/14/typedurls-part-1/
https://www.crowdstrike.com/blog/how-to-employ-featureusage-for-windows-10-taskbar-forensics/
https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
https://thinkdfir.com/2020/10/23/when-did-recentapps-go/
https://df-stream.com/2017/10/recentapps/
https://github.com/volatilityfoundation/community/blob/master/ThomasChopitea/autoruns.py
https://www.istrosec.com/blog/windows-10-timeline/
https://kacos2000.github.io/WindowsTimeline/WindowsTimeline.pdf
https://bohops.com/2021/03/16/investigating-net-clr-usage-log-tampering-techniques-for-edr-evasion/
https://www.youtube.com/watch?v=rioVumJB0Fo
https://www.youtube.com/watch?v=qxPoKNmnuIQ
https://www.13cubed.com/downloads/windows_registry_cheat_sheet.pdf
https://www.hecfblog.com/2013/08/daily-blog-67-understanding-artifacts.html
https://learn.microsoft.com/en-us/windows-hardware/drivers/storage/supporting-mount-manager-requests-in-a-storage-class-driver
https://www.sans.org/blog/computer-forensic-guide-to-profiling-usb-device-thumbdrives-on-win7-vista-and-xp/
http://windowsir.blogspot.com/2013/04/plugin-emdmgmt.html
https://www.hecfblog.com/2013/08/daily-blog-66-understanding-artifacts.html
http://website.bcmsystem.com/orion/wp-content/uploads/2019/05/Microsoft-Windows-10-USB-Forensic-Artefacts.pdf
https://lifars.com/wp-content/uploads/2020/04/LIFARS-WhitePaper-Windows-ShellBags-Forensics-Investigative-Value-of-Windows-ShellBags.pdf
https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/
https://www.youtube.com/watch?v=rV8aErDj06A
https://www.netsurion.com/articles/following-a-users-logon-tracks-throughout-the-windows-domain
https://threathunterplaybook.com/hunts/windows/190511-RemotePwshExecution/notebook.html
https://www.ntfs.com/
https://github.com/jschicht/Secure2Csv
https://www.forensicsmyanmar.com/2022/08/ntfs-index-attributes.html
https://dfir.ru/2021/01/10/standard_information-vs-file_name/
https://en.wikipedia.org/wiki/Windows_thumbnail_cache
https://thumbcacheviewer.github.io/
https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2429795
https://www.13cubed.com/downloads/windows_browser_artifacts_cheat_sheet.pdf
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4776
https://mandiant.com/resources/blog/digging-up-the-past-windows-registry-forensics-revisited
https://www.mdpi.com/2673-6756/2/1/7
Last updated