Windows Artifact Analysis
Windows Artifact Analysis
This domain tests correlation of Windows artifacts to answer who, what, when, and how. No single artifact proves user action; the exam rewards corroboration.
Key artifacts
- Registry: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, and UsrClass.dat, plus transaction logs. Persistence includes Run keys, services, scheduled tasks, and WMI subscriptions.
- Execution: Prefetch, Amcache, ShimCache/AppCompatCache, UserAssist, and BAM/DAM. Prefetch indicates execution but may be disabled; ShimCache shows presence/compatibility, not definitive execution by itself.
- File and folder access: LNK files, Jump Lists, Shellbags, RecentDocs, and MUICache.
- USB: SYSTEM\Enum\USBSTOR, MountedDevices, and setupapi.dev.log.
- Browsers: History, Cookies, Cache, Web Data, and downloads. Also Recycle Bin $I/$R, SRUM, EVTX logs, PowerShell logs, Volume Shadow Copies, and $MFT.
Worked example
To show a USB drive was connected, correlate the USBSTOR serial with the MountedDevices volume GUID, a LNK file pointing to a file on that drive, and setupapi.dev.log entries. Each artifact supports a different part of the claim; together they are stronger than any one alone. State the time zone and normalize timestamps.
Traps
Treating ShimCache as proof of execution; assuming Prefetch exists on servers or SSD systems; ignoring UTC offsets; attributing actions to a user without corroboration; overlooking alternate data streams and shadow copies.
Key points
- Correlate multiple artifacts before asserting user action.
- USBSTOR, MountedDevices, and LNK files support USB connection claims.
- Prefetch indicates execution but may be absent.
- ShimCache is not definitive execution evidence.
- Normalize timestamps and state the time zone.