Windows Forensics

What it is and why it matters

Most computers that reach a forensic laboratory run Windows, which is why the Windows artefact set is the first thing an examiner learns in depth. The operating system was never designed to keep evidence, but its habit of caching, indexing and logging for performance and troubleshooting leaves a dense trail. A program that ran last month has a prefetch file. A folder that was opened has a shellbag entry. A USB stick that was plugged in once has a registry key and a line in a setup log.

The examiner's work is to read these records from a verified image, understand the conditions under which each one is written and then combine them. One artefact rarely proves anything on its own. Prefetch says a program ran, the Security log says who was logged on, the USN journal says which files were written during those minutes, and together they tell a story that can be tested.

Windows also changes with every release. Artefact locations move, new databases appear and old ones are retired. BitLocker is now switched on by default on many new machines, which turns an unplanned shutdown into a locked drive. Keeping up with these changes is part of the discipline, and so is checking a tool's interpretation against the raw data when a finding matters.

Types of digital evidence

Registry Hives
SYSTEM, SOFTWARE, SAM, SECURITY and DEFAULT in C:\Windows\System32\config, NTUSER.DAT in each profile and UsrClass.dat under AppData\Local. They hold accounts, installed software, network interfaces, USB history, recent documents and the last-write time of every key.
Windows Event Logs
The .evtx files in C:\Windows\System32\winevt\Logs. The Security log records logons (4624), failed logons (4625) and audit clearing (1102). The System log records service installs (7045) and shutdowns. Dozens of operational logs cover PowerShell, Remote Desktop, scheduled tasks and Defender.
NTFS Metadata
The $MFT with its two sets of timestamps, the $LogFile transaction log, the $UsnJrnl change journal and the $I30 index records that keep names of deleted files inside their parent folder.
Program Execution Records
Prefetch files in C:\Windows\Prefetch with the last eight run times, the ShimCache and BAM keys in the SYSTEM hive, Amcache.hve under C:\Windows\appcompat\Programs and UserAssist counts in NTUSER.DAT.
File and Folder Access Records
LNK shortcuts and jump lists in the Recent folder, shellbags in NTUSER.DAT and UsrClass.dat, RecentDocs and Office MRU keys and the Windows Search index in Windows.edb.
Device and Network History
USBSTOR and MountedDevices keys, setupapi.dev.log in C:\Windows\INF, Wi-Fi profile keys with first and last connection times and SRUM, the System Resource Usage Monitor database that records network bytes per application per hour.
Volatile Remnants on Disk
hiberfil.sys, pagefile.sys and swapfile.sys, which can hold memory contents, passwords and fragments of files long after the session ended.
Volume Shadow Copies
Point-in-time snapshots kept by the Volume Shadow Copy Service that preserve earlier versions of the registry, the logs and user files.

Devices and data sources

Desktop and laptop system drives, imaged through a write-blocker or captured live when BitLocker is active
Windows Server volumes, including domain controllers with the Active Directory database ntds.dit
User profile folders and the AppData tree, where most application data lives
Windows.old folders and previous installations left by upgrades
Virtual machine disk files hosting Windows guests
RAM captures from running machines, for the live registry, decrypted volumes and network state
External drives and USB sticks, which carry their own LNK files, thumbnails and Recycle Bin folders
OneDrive, Teams and Outlook caches that mirror cloud and mail data on the local disk
Backup sets, system images and File History folders

How an examination runs

The order matters. Each step protects the one after it.

01
Decide on Live Capture
If the machine is on, check for BitLocker and record the state of the session. Capture RAM and, where authorised, the BitLocker recovery information before any shutdown. A TPM-only BitLocker drive unlocks on its own machine but not in an imaging rig.
02
Image and Verify
Acquire the system drive through a write-blocker, hash it and open the image to confirm the volumes are readable. Note the Windows edition and build from the SOFTWARE hive before going further, because artefact locations depend on it.
03
Collect the Artefact Set
Pull the registry hives, event logs, $MFT, $LogFile, $UsnJrnl, prefetch, jump lists, LNK files, SRUM, Amcache and the hibernation and page files from the image. Targeted collection tools make this repeatable and record what was taken.
04
Settle the Clock
Read the time zone and daylight saving settings from the SYSTEM hive and compare the last shutdown time with the newest log entries. Convert everything to one reference time before building any sequence.
05
Parse Each Artefact
Run the hives, logs and file system records through parsers that output tables, then read the raw structures for any record that will carry weight in the report.
06
Build the Timeline
Merge the parsed output into one timeline and look for the events around the question asked. The value is in overlap: a logon, a program start, a file write and a USB connection within the same minutes.
07
Check Shadow Copies and Backups
Mount each Volume Shadow Copy and compare earlier registry and log versions with the live ones. Deleted events and files often survive there.
08
Report With Conditions
For each finding, state what the artefact records, what has to be true for it to be written and what it does not show. Prefetch proves execution, not who pressed the key.

Tools used in this discipline

Independent profiles: what each tool does, where it stops and what you need to know before using it.

Browse the full tools directory

Terminology

Registry Hive: One file of the registry database. Each key inside carries a last-write time, which is often the only timestamp an examiner has for a configuration change.
FILETIME: The Windows timestamp format, counted in 100-nanosecond intervals since 1 January 1601 in UTC. Most artefacts use it, and most tools convert it silently.
$STANDARD_INFORMATION and $FILE_NAME: The two timestamp sets in an $MFT record. Tools that alter timestamps usually change only the first, so a mismatch between the two is a sign of tampering.
USN Journal: The NTFS change journal, kept in $Extend\$UsnJrnl. It logs every create, rename, write and delete on the volume with a timestamp and the file's record number.
Prefetch: A file Windows writes to speed up the next launch of a program. Its name contains the executable name and a hash of its path, and it stores run counts and recent run times.
Shellbags: Registry entries that remember the size and position of Explorer windows. As a side effect they list folders the user opened, including folders on removable drives and network shares that no longer exist.
Jump List: Per-application lists of recent and pinned items in AutomaticDestinations and CustomDestinations files, each entry holding an embedded LNK structure with the target's path and timestamps.
SRUM: The System Resource Usage Monitor database in C:\Windows\System32\sru\SRUDB.dat. It records application network use, energy use and process activity in hourly buckets for about a month.
Amcache and ShimCache: Two application compatibility records. Amcache stores file hashes and paths of executables seen by the system. ShimCache stores paths and last-modified times of executables, not run times.
Volume Shadow Copy: A snapshot of a volume at block level. Windows creates them before updates and restore points, and they preserve older versions of files, hives and logs.

Challenges and limits

What makes it hard

BitLocker and device encryption are on by default on many new Windows 11 machines, so an image taken without the recovery key or a live session is ciphertext
Artefact names and locations move between Windows versions, and a parser built for one build may misread another
Event logs roll over and the Security log on a busy machine may cover only days, so the evidence may be gone before the question is asked
Timestamps in different artefacts use different formats, precisions and time zones, and a single mistake shifts a whole timeline
Anti-forensic tools can clear logs, wipe prefetch and alter $STANDARD_INFORMATION times, so the examiner looks for the signs of cleaning as evidence in its own right
Cloud-synced folders and Microsoft accounts move much user data off the disk and under another legal regime
Automated tools present interpretations as facts, and a popular parser misreading one field can mislead a whole case

Keeping the evidence intact

Record the Windows edition, build number and time zone settings from the hives before any analysis
Hash every extracted artefact file and keep it with the path and $MFT record number it came from
Work on copies of the hives and logs so that the originals in the image stay unchanged
Validate every parser against known data before trusting it with a case, and keep the version number in the notes
Keep a written time reference showing how each timestamp was converted to the reporting time zone

Standards and legal considerations

NIST SP 800-86
Guide to Integrating Forensic Techniques into Incident Response. Its treatment of operating system data, logs and application artefacts is the general framework for a Windows examination.
Read the guide
ISO/IEC 27037:2012
The guideline for identifying, collecting and preserving digital evidence, which decides how the Windows machine is seized and imaged.
Read the guide
ISO/IEC 27042:2015
Guidance on analysis and interpretation, which matters when the meaning of an artefact is argued in court.
Read the guide
SWGDE Best Practices
SWGDE documents on computer forensic examination and on the validation of tools, both of which a Windows examination depends on.
Read the guide

In practice

Was the Spreadsheet Opened or Only Present
A manager is accused of reading a confidential salary file. The file exists on the laptop. The examiner finds an LNK file and a jump list entry for the spreadsheet under the manager's profile, a prefetch run of the spreadsheet program at the same minute and a UserAssist count, and concludes the file was opened on that date from that account.
A Cleared Security Log
An administrator says the server was never accessed outside office hours. The Security log begins at 9 am on a Monday and the System log shows event 1102 just before it. A Volume Shadow Copy from the previous Friday holds the earlier Security log, which records remote logons on Saturday night from an internal address.
The Laptop That Was Encrypted Overnight
A seized laptop is switched off by a colleague before the examiner arrives. The drive is BitLocker-protected with a TPM-only protector. Without the recovery key the image is unreadable. The examiner documents the state, requests the key from the organisation's directory under authority and only then begins the examination.

This page is educational material, not legal advice. Laws and standards change, commence on different dates and are interpreted differently across jurisdictions. Always read the official text linked on this page and take advice from a qualified professional for a real matter.

Learn it at DFRTI

Free pages explain. These courses teach it on real devices with a mentor.

LegalFoundation & Legal CoursesBasics of Cyber ForensicsStart here. Evidence handling, imaging, hashing, chain of custody and your first analysis.BeginnerDCFA

StorageDigital Storage ForensicsFile System AnalysisRead NTFS, FAT, exFAT, ext4 and APFS at the structure level and build timelines.IntermediateDCFA

StorageDigital Storage ForensicsHDD ForensicsImage hard drives through a write-blocker, find hidden areas and recover deleted data.IntermediateDCFA

LegalFoundation & Legal CoursesForensic Report WritingWrite clear forensic reports that answer the questions asked and survive cross-examination.IntermediateDCFA

Careers that use it

Questions people ask

Which artefact proves that a program was run?

Prefetch is the most direct, since Windows writes it when a program launches and stores recent run times. Amcache and ShimCache show that an executable existed and was seen by the system, which is weaker. UserAssist and BAM add the user account. The strongest finding combines two or more of these.

Can a deleted file's name be recovered when the content is gone?

Often. The USN journal, the $LogFile, $I30 index slack in the parent folder, LNK files and jump lists all record file names independently of the content. The report should say that the name was recovered, not the file.

What happens if I shut down a running Windows machine?

You lose RAM, which can hold the BitLocker volume key, passwords and running malware. You may also lose access entirely if BitLocker is active. The usual advice is to capture memory first and check encryption before any shutdown, and to record who decided what.

Are the event logs enough to reconstruct an intrusion?

Rarely on their own. Process creation logging is off by default, PowerShell logging may be off and logs roll over. The file system journals, SRUM, scheduled task files and registry keys fill many gaps, and a memory capture fills more.