01 · Acquisition & Triage
Windows Acquisition and Triage with KAPE and Velociraptor
Acquire Windows evidence in the right order: memory first, disk images, BitLocker, KAPE and Velociraptor triage, cloud snapshots and chain of custody.
Windows DFIR field reference
Investigate Windows hosts with confidence.
Where the evidence lives, what it proves and how to parse it: the registry, event logs, Prefetch and Amcache, NTFS, ShellBags and LNK files, persistence, lateral movement, USB and memory.
- artifact cheat sheets
- 75
- in-depth guides
- 21
- investigation areas
- 12
super-timeline · WKS-FIN-07UTC
- 02:13:07Security 4624Logon type 10 (RDP) · svc-backup from 203.0.113.50
- 02:13:52$MFTC:\Users\Public\rc.exe created · $SI = $FN
- 02:14:05PrefetchRC.EXE-4F2A9C1D.pf · run count 1
- 02:14:06Amcache.hverc.exe · SHA-1 9f1c…e04b · unsigned
- 02:15:10System 7045Service installed: WinSvcHelper → rc.exe
- 02:16:44NTUSER.DATRun\OneDriveSync → C:\Users\Public\rc.exe
- 02:31:55Security 1102The audit log was cleared · svc-backup
PS>psort.py -o l2tcsv -w case.csv case.plaso "date > '2026-03-14 02:10:00'"
C:\Evidence\
The Windows forensics map
Twelve areas cover the evidence that matters on a compromised Windows host. Each links to deep guides and to the artifact cheat sheets behind them.
- 01
Acquisition & Triage
Capture memory, image disks and run triage collectors without trampling the evidence.
- KAPE
- FTK Imager
- Velociraptor
3 guides5 artifacts - 02
Registry
Read hives offline: system configuration, user accounts, MRU lists and last write times.
- SYSTEM
- NTUSER.DAT
- UsrClass.dat
1 guide10 artifacts - 03
Event Logs
Logons, process creation, services and PowerShell: the event IDs that carry an investigation.
- Security.evtx
- Sysmon
- 4624 / 4688
2 guides8 artifacts - 04
Evidence of Execution
Prove a program actually ran, when, how often and from where, and know which artifacts only prove presence.
- Prefetch
- Amcache.hve
- ShimCache
3 guides14 artifacts - 05
NTFS & File System
Read the MFT, USN journal and $LogFile to rebuild file creation, renames, deletions and timestomping.
- $MFT
- $UsnJrnl:$J
- $LogFile
1 guide8 artifacts - 06
User Activity
Reconstruct which files and folders a user opened, searched for and browsed, and when.
- ShellBags
- LNK
- Jump Lists
3 guides21 artifacts - 07
Persistence
Hunt Run keys, services, scheduled tasks, WMI subscriptions, IFEO and COM hijacks.
- Run keys
- Services
- Scheduled Tasks
1 guide11 artifacts - 08
Lateral Movement
Trace RDP, PsExec, WMI and WinRM between hosts from both the source and the destination side.
- 4624 type 10
- PsExec
- WinRM
3 guides10 artifacts - 09
USB & External Devices
Identify devices, first and last connection times, the user who mounted them and the files opened from them.
- USBSTOR
- setupapi.dev.log
- Partition/Diagnostic
1 guide7 artifacts - 10
Memory Forensics
Capture RAM and analyse it with Volatility 3 and MemProcFS to find injected code and live connections.
- Volatility 3
- hiberfil.sys
- pagefile.sys
1 guide4 artifacts - 11
Anti-Forensics
Detect log clearing, timestomping, wiping and shadow copy deletion, and find what survives.
- 1102
- vssadmin
- SDelete
1 guide8 artifacts - 12
Timeline Analysis
Merge every source into one UTC super-timeline and pivot from a known-bad moment.
- Plaso
- Timeline Explorer
- MACB
1 guide6 artifacts
workflow
From first alert to a defensible timeline
The same five phases apply whether you are looking at one laptop or a whole Active Directory domain.
- 01
Preserve
Capture memory first, then image disks or snapshot VMs, hash everything and log every action.
- 02
Triage
Pull hives, event logs, Prefetch, $MFT and user artifacts in minutes with KAPE or Velociraptor.
- 03
Analyse
Prove execution, file access, persistence and logons with the right artifact for each question.
- 04
Correlate
Merge registry, event log and NTFS evidence into one UTC super-timeline and pivot.
- 05
Report
State what each artifact proves, what it cannot prove, and how you verified it.
cheat sheets
Every artifact on one page
75 artifact sheets give the location by Windows version, what the artifact proves, how to read its timestamps, how to collect it and which tools parse it.
guides
Latest guides
03 · Event Logs
Active Directory Forensics: Domain Controller Event Logs
Investigate domain controllers: Kerberos and NTLM events, account and group changes, DCSync 4662, directory changes, GPO abuse, NTDS.dit theft, forged tickets.
08 · Lateral Movement
Credential Access Forensics: LSASS, DCSync and Kerberoasting
Investigate Windows credential theft: LSASS dumps, SAM and NTDS.dit extraction, DCSync, DPAPI, Kerberoasting and AS-REP roasting, with event IDs and ATT&CK.
11 · Anti-Forensics
Detecting Windows Anti-Forensics: What Survives the Cleanup
Detect log clearing, timestomping, secure deletion, VSS deletion and Defender tampering on Windows, mapped to MITRE ATT&CK, with the traces each one leaves.
07 · Persistence
Hunting Windows Persistence: Registry, Tasks, WMI and More
Find attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
08 · Lateral Movement
Lateral Movement Forensics: RDP, PsExec, WMI and WinRM
Map source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
glossary
Speak the language
Short, precise definitions of the terms you will meet in Windows investigations.
Open the glossary- Alternate Data Stream (ADS)
- Anti-forensics
- ControlSet and CurrentControlSet
- ESE database (Extensible Storage Engine)
- Event Tracing for Windows (ETW)
- Windows event ID
- Evidence of execution
- File carving
- File slack
- FILETIME
- Jump List AppID
- Registry key LastWrite time
- Lateral movement
- Logon type
- LOLBin (living-off-the-land binary)
- Mark of the Web (MOTW)
- MFT file reference number
- NTFS
- NTUSER.DAT
- Persistence
- Registry transaction logs (.LOG1/.LOG2)
- Resident data
- Security Identifier (SID)
- Shell item (ShellItem / PIDL)
- SQLite write-ahead log (-wal)
- $STANDARD_INFORMATION vs $FILE_NAME
- Super timeline
- Triage collection
- Unallocated space
- UsrClass.dat
- UTC vs local time in Windows artifacts
- Volume serial number
- Chain of Custody
- MACB Timestamps
- Master File Table (MFT)
- Order of Volatility
- Registry Hive
- Timestomping
- Volume Shadow Copy (VSS)
- Write Blocker