Cheat sheet
Windows artefacts
The traces a program or a user leaves on a Windows host, and where to find them. The approach is in Forensics (DFIR).
CDSAForensics
Evidence of execution
| Artefact | What it shows | Location |
|---|---|---|
| Prefetch | Program run, run count and last run times | C:\Windows\Prefetch\*.pf |
| Amcache | Programs present or run, with their SHA-1 | C:\Windows\AppCompat\Programs\Amcache.hve |
| Shimcache | Programs seen by the system (presence, not necessarily execution) | SYSTEM hive (AppCompatCache) |
| UserAssist | Programs started from the graphical interface, per user | NTUSER.DAT |
| BAM | Last run of a program, per user | SYSTEM hive (Services\bam) |
| SRUM | Resources and network volume used per application | C:\Windows\System32\sru\SRUDB.dat |
Presence or execution?Shimcache and Amcache mostly prove that a file existed; Prefetch, UserAssist and BAM prove that it was run. Always cross-check several sources.
User activity
| Artefact | What it shows | Location |
|---|---|---|
| ShellBags | Folders opened in Explorer, even if deleted since | UsrClass.dat, NTUSER.DAT |
| LNK | Files opened, through automatically created shortcuts | %APPDATA%\Microsoft\Windows\Recent |
| Jump Lists | Recent files per application | …\Recent\AutomaticDestinations |
| RecentDocs | Recently opened documents, per extension | NTUSER.DAT |
| TypedPaths | Paths typed in the Explorer address bar | NTUSER.DAT |
| Recycle Bin ($I, $R) | Deleted files: original path and deletion date | C:\$Recycle.Bin |
Registry hives
| Hive | Contents | Location |
|---|---|---|
| SAM | Local accounts and their hashes | C:\Windows\System32\config\SAM |
| SYSTEM | Configuration, services, Shimcache, BAM | C:\Windows\System32\config\SYSTEM |
| SOFTWARE | Installed programs, machine Run keys | C:\Windows\System32\config\SOFTWARE |
| SECURITY | LSA secrets and security policy | C:\Windows\System32\config\SECURITY |
| NTUSER.DAT | User profile: Run keys, UserAssist, RecentDocs | C:\Users\<user>\NTUSER.DAT |
| UsrClass.dat | User ShellBags | …\AppData\Local\Microsoft\Windows\UsrClass.dat |
Eric Zimmerman's tools
| Tool | Artefact parsed |
|---|---|
| PECmd | Prefetch |
| AmcacheParser | Amcache |
| AppCompatCacheParser | Shimcache |
| SBECmd | ShellBags |
| LECmd | LNK files |
| JLECmd | Jump Lists |
| MFTECmd | $MFT and $UsnJrnl |
| RECmd | Registry (whole hives) |
| EvtxECmd | .evtx event logs |
# Example: all the Prefetch of a mounted image, as CSV for Timeline Explorer PECmd.exe -d E:\Windows\Prefetch --csv C:\analysis --csvf prefetch.csv # Quick collection of a host's artefacts: KAPE (!SANS_Triage targets) or Velociraptor