Windows forensic artefacts: what the user did
From Prefetch, LNK files, jump lists, shellbags, Amcache and USB history you work out which program a Windows user ran and when, which files they opened and which devices they plugged in.
Level 201 · 18 lessons · 15 practice labs
Lessons
The Windows evidence map
- Where evidence lives in Windows: file system, registry, event logs
- User profile folders: AppData, Recent, Desktop
- Windows time formats: FILETIME and time zones
- Reading Windows artefacts from Linux: Eric Zimmerman’s tools and open-source equivalents
- Short task: identify the users and the time zone in an image
Evidence of execution
- Prefetch: which program ran, when and how often
- Amcache and Shimcache: records of executed files
- UserAssist and BAM: programs the user launched
- SRUM: per-application network and resource use
- Short task: prove which tool the attacker ran and when
File and folder access
- LNK shortcut files: the opened file’s path and volume
- Jump lists: recent files per application
- Shellbags: the folders the user browsed
- The Recycle Bin: $I and $R files
- Short task: find when the deleted confidential file was opened
Devices and capstone
- USB device history: serial number, first and last connection
- Tying a device to files via MountedDevices and volume names
- Capstone: prove an employee copied data out on a USB drive
Practice labs
- Identify the users and time zone in the image: Extract the user profiles and the system time zone from a Windows image.
- Convert a FILETIME value: Convert three raw FILETIME values to UTC and local time.
- User activity from the profile folders: Summarise a user's last day from the AppData, Recent and Desktop folders.
- Read the run count from Prefetch: Extract the program name, run count and last run times from a Prefetch file.
- Compare Amcache and Shimcache: Find the same executable's trace in both records and write what each one proves.
- Prove the tool that ran and when: Prove the tool run without authorisation in a prepared image from three angles with Prefetch, Amcache and Shimcache.
- Programs launched according to UserAssist: Decode the UserAssist entries and list the five programs the user launched most.
- Last run time with BAM: Extract the last programs run per user and their times from BAM records.
- Per-application network use from SRUM: Find the application sending the most data on the incident day and its volume from the SRUM database.
- Read the opened path from an LNK file: Extract the target path, volume serial number and times from a shortcut file.
- Decode the file in the Recycle Bin: Find the deleted document's original path and deletion time from the $I and $R files.
- When the deleted confidential document was opened: Combine LNK, jump list and shellbag traces to prove when and from where the deleted document was opened.
- List the USB device history: List the USB storage devices that were attached with vendor, product and serial number.
- Tie the device to a drive letter: Use MountedDevices and volume names to match a USB stick to a drive letter and a user.
- Prove data left on a USB stick: In the Karaçam Mobilya case, combine first and last connection times with shortcut traces to prove which files were copied to the stick.
About this course
From Prefetch, LNK files, jump lists, shellbags, Amcache and USB history you work out which program a Windows user ran and when, which files they opened and which devices they plugged in.
What you will learn
- The Windows evidence map
- Evidence of execution
- File and folder access
- Devices and capstone
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.