Home front-page port 80-shoopyuWindows Artifacts
Post
Cancel

front-page port 80-shoopyuWindows Artifacts

System and User Information (via Registry)

ArtifactFilesystem LocationTools or CommandsOperating System Version
System InformationSOFTWARE\Microsoft\Windows NT\CurrentVersionRegistry Explorer 
Computer NameSYSTEM\CurrentControlSet\Control\ComputerName\ComputerNameRegistry Explorer 
System Last Shutdown TimeSYSTEM\CurrentControlSet\Control\WindowsRegistry Explorer 
Cloud Account DetailsSAM\Domains\Account\Users<RID>\InternetUserNameRegistry Explorer 
User AccountsSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileListRegistry Explorer 
Last Login and Password ChangeSAM\Domains\Account\UsersRegistry Explorer 

Application Execution **

ArtifactFilesystem LocationTools or Commands
ShimcacheSYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCacheRegRipper
Amcache.hveC:\Windows\AppCompat\Programs\Amcache.hveRegistry Explorer
UserAssistNTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\Registry Explorer
Win10 TimelineC:\%USERPROFILE%\AppData\Local\ConnectedDevicesPlatform\L.Administrator\ActivitiesCache.dbWxTCmd.exe
SRUMC:\Windows\System32\sru\SRUDB.datsrum-dump
BAM / DAMSYSTEM\ControlSet001\Services\bam\State\UserSettings\Registry Explorer
Prefetch, MFT, USNJC:\Windows\prefetchPECmd.exe

File and Folder Opening **

ArtifactFilesystem LocationTools or Commands 
ShellbagNTUSER.dat\Software\Microsoft\Windows\Shell\BagsShellbags Explorer 
Open/Save MRUNTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRURegistry Explorer 
Shortcut (LNK) Files%USERPROFILE%\AppData\Roaming\Microsoft\WindowsOffice\Recent\Autopsy
JumplistC:\%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinationsJumplist Explorer 

Deleted Items and File Existence **

ArtifactFilesystem LocationTools or Commands
Recycle BinC:$Recycle.BinRecbin
Thumbcache%USERPROFILE%\AppData\Local\Microsoft\Windows\ExplorerThumbcache Viewer
User Typed PathsNTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPathsRegistry Explorer

Browser Activity **

ArtifactFilesystem LocationTools or Commands
Browser activityC:\Users\%user%\AppData\Local\Roaming\BrowserNameDBBrowser

Network Usage **

ArtifactFilesystem LocationTools or Commands
Network HistorySOFTWARE\Microsoft\Windows NT\CurrentVersion\Network*Registry Explorer
TimezoneSYSTEM\CurrentControlSet\Control\TimeZoneInformationRegistry Explorer
WLAN Event LogMicrosoft-Windows-WLAN-AutoConfig Operational.evtxEvent log viewer

USB Usage **

ArtifactFilesystem LocationTools or Commands
USB Device IdentificationSYSTEM\CurrentControlSet\Enum*Registry Explorer
Drive Letter and Volume NameSOFTWARE\Microsoft\Windows Portable Devices\Devices and SYSTEM\MountedDevicesRegistry Explorer

AntiVirus Logs **

AntiVirusFilesystem Location
AvastC:\ProgramData\Avast Software\
AVGC:\ProgramData\AVG\Antivirus\
AviraC:\ProgramData\Avira\Antivirus\LOGFILES\
BitdefenderC:\Program Files\Bitdefender\

Other Artifacts

ArtifactFilesystem LocationTools or Commands
Startup folder (user)C:\%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartupAutopsy
Shadow copy Shadow Explorer
Hiberfil.sysC:\Hibernation Recon
Pagefile.sysC:\strings, Unalloc
AnydeskC:\Users\%user%\AppData\Roaming\AnyDesk* or C:\ProgramData\AnyDesk*Autopsy
WMI persistenceC:\WINDOWS\system32\wbem\Repository\OBJECTS.DATAWMI_Forensics
RDP CacheC:\%USERPROFILE%\AppData/Local/Microsoft/Terminal Server Client/CacheBMC-Tools
This post is licensed under CC BY 4.0 by the author.

front-page port 80-shoopyuGiolocating Images

front-page port 80-shoopyu Linux Privilege Escalation 🦁