Print-optimized layout (A4 landscape). Use Print → “Save as PDF” to download it.Back to the cheat sheet
Windows Artifacts Cheat Sheet
www.windowsforensics.app/en/artifacts
Execution
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| Amcache.hve | C:\Windows\AppCompat\Programs\Amcache.hve | A binary was present (path, SHA-1, PE metadata); often, but not always, that it ranEntry key LastWrite as FILETIME, UTC; PE LinkDate (compile time, UTC); InstallDate string whose format varies by build | Amcache |
| BAM / DAM (Background Activity Moderator) | SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID> | Which user ran which executable, and when it last ranLast execution time per executable (first 8 bytes of the value data) as FILETIME, UTC; SID key LastWrite | RegistryHivesSystem |
| Crash dumps (MEMORY.DMP, minidumps) | C:\Windows\MEMORY.DMP | Memory state at a crash, which driver or process crashed, and attacker process dumpsDump header system time in UTC; dump file NTFS times (MEMORY.DMP is written at the reboot after the crash); System event 1001 | MemoryFiles, WER |
| Event Trace Logs (ETL files) | C:\Windows\System32\LogFiles\WMI\*.etl | Low-level system activity (boot processes, Wi-Fi connections, updates) recorded by ETW sessionsPer-event raw clock (QPC, system time or CPU cycles) converted to FILETIME, UTC; header start/end times; .etl NTFS times | EventTraceLogs, WindowsUpdate |
| hiberfil.sys (hibernation file) | C:\hiberfil.sys | Memory state at the last hibernation or Fast Startup: processes, connections, codeFile modification time (NTFS, UTC) marks the last hibernation or Fast Startup; in-memory structures hold mostly FILETIME, UTC | MemoryFiles |
| Installed Programs (Uninstall Keys, MSI, AppX) | HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall | Which software was installed or removed, where, roughly when and, for MSI installs, by which accountUninstall key LastWrite (FILETIME, UTC), InstallDate string (YYYYMMDD, local date, no time), MsiInstaller event times (UTC), Amcache InstallDate | RegistryHivesSystem, RegistryHivesUser, EventLogs, Amcache |
| Microsoft Defender logs and quarantine | C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log | Malware was present or ran, what Defender did, and who weakened its settingsEvent TimeCreated and quarantine time as FILETIME, UTC; 1116 Detection Time in ISO 8601, UTC; MPLog lines ISO 8601, some without zone | WindowsDefender, WinDefendDetectionHist |
| MUICache | UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\MuiCache | A user's shell resolved an executable's display name, usually because it ranOnly the MuiCache key LastWrite as FILETIME, UTC; individual entries carry no time | RegistryHivesUser |
| pagefile.sys and swapfile.sys | C:\pagefile.sys | Fragments of past memory: commands, URLs, credentials, file and process tracesNo per-fragment timestamps; file $SI times (NTFS, UTC) change constantly; any dates come from the fragment content itself | MemoryFiles |
| PE files (Windows executables) | Any .exe, .dll, .sys, .scr, .cpl on disk or extracted from memory | What a binary is, who built and signed it, and whether it matches known tools or malwarePE TimeDateStamp as UNIX time, UTC (easily forged); Authenticode countersignature time, UTC; file $SI/$FN times, UTC | Velo: PrefetchBinaries |
| PowerShell logs and history | C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx | Which PowerShell code ran, under which account, and when; typed commands per userEvent TimeCreated as FILETIME, UTC; PSReadLine lines undated (file $SI only); transcript names and headers in local time, no zone | EventLogs, PowerShellConsole, PowerShellTranscripts |
| Prefetch Files (.pf) | C:\Windows\Prefetch\<EXE>-<HASH>.pf | A specific executable ran, how many times, and when (up to 8 run times)Last 8 run times (1 before Windows 8) as FILETIME, UTC, about 10 s after launch; .pf file $SI times, UTC | Prefetch |
| Program Compatibility Assistant (PCA) | C:\Windows\appcompat\pca\PcaAppLaunchDic.txt | A program was launched from the GUI and when it last ran (Windows 11 22H2+)Last GUI launch per path in PcaAppLaunchDic.txt and PcaGeneralDb record times, text UTC; Store key LastWrite as FILETIME, UTC | AppCompatPCA |
| RecentFileCache.bcf | C:\Windows\AppCompat\Programs\RecentFileCache.bcf | Executables recently launched on a Windows 7 / Server 2008 R2 hostNo timestamps inside the file; only the .bcf $SI modification time (NTFS, UTC) of the last update | RecentFileCache |
| RunMRU | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU | A user typed these commands, paths or URLs in the Run dialog, in this orderRunMRU key LastWrite as FILETIME, UTC, dating only the most recent command; older entries undated | RegistryHivesUser |
| ShimCache (AppCompatCache) | SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache | A file path was seen by the compatibility engine; on Win 7/8, likely executionPer-entry file $SI modification time as FILETIME, UTC (not an execution time); SYSTEM key LastWrite marks the last flush | RegistryHivesSystem |
| SRUM (System Resource Usage Monitor) | C:\Windows\System32\sru\SRUDB.dat | An app ran for a user in a given hour and how many bytes it sent and receivedTimeStamp as OLE date, UTC, marking the end of a roughly hourly window; ConnectStartTime as FILETIME, UTC | SRUM |
| Syscache.hve | C:\System Volume Information\Syscache.hve | An executable with this SHA-1 and MFT file ID was recorded on the volumeObjectTable record key LastWrite as FILETIME, UTC; the only per-record time | Syscache |
| Sysmon Event Log | C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx | Process creation with full command line and hashes, network connections, file, registry and DNS activity, as filtered by the configUtcTime field in each event (UTC, millisecond string) plus the EVTX TimeCreated (UTC, FILETIME precision) | EventLogs |
| UserAssist | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count | A user launched a program or shortcut through Explorer, how often and when lastLast run time per entry and Count key LastWrite as FILETIME, UTC; value names are ROT13-encoded | RegistryHivesUser |
| Windows Error Reporting (WER) | C:\ProgramData\Microsoft\Windows\WER\ReportArchive\<ReportFolder>\Report.wer | A program ran and crashed or hung, with its full path, time and sometimes its SHA-1Report.wer EventTime and app start time as FILETIME, UTC; Application events 1000/1001/1002 in UTC; folder $SI times less reliable | WER |
| Windows event logs (EVTX) | C:\Windows\System32\winevt\Logs\*.evtx | Logons, process creation, service and task installs, log clearing, and much moreTimeCreated SystemTime as FILETIME, UTC (Event Viewer shows local time); some EventData fields hold local-time strings | EventLogs |
| Windows Subsystem for Linux (WSL) | HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss | A Linux distribution was installed for a user, where its file system lives, and that WSL binaries were executedLxss subkey LastWrite (FILETIME, UTC), Prefetch/Amcache times for wsl.exe (UTC), Linux inode times inside the distro (Unix epoch, UTC) | RegistryHivesUser, Prefetch, Amcache |
Persistence
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| BITS jobs (qmgr database) | C:\ProgramData\Microsoft\Network\Downloader\qmgr.db | A BITS job transferred a file from or to a URL, and may run a command on completionJob creation/modification as FILETIME, UTC in qmgr.db; Bits-Client EVTX events in UTC; destination file NTFS times | BITS, EventLogs |
| Group Policy artifacts | %SystemRoot%\System32\GroupPolicy\ | Which policies applied to a machine or user, when, and whether a GPO was weaponisedRegistry.pol and XML file $SI/$FN times (NTFS UTC); History key LastWrite (UTC); gpttmpl versionNumber | — |
| IFEO and Winlogon persistence | SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<exe> | A program launch, process exit or user logon was hijacked to run another binaryIFEO, SilentProcessExit and Winlogon key LastWrite as FILETIME, UTC; replaced accessibility binaries carry NTFS $SI/$FN times | RegistryHivesSystem, RegistryHivesUser |
| Kernel Drivers (.sys, Driver Services, BYOVD) | C:\Windows\System32\drivers\*.sys | A kernel driver was installed or registered as a service, when, from which path, and whether Windows blocked or loaded itServices key LastWrite (FILETIME, UTC), event 7045/4697 and CodeIntegrity times (UTC), setupapi.dev.log section times (local time), .sys file $SI/$FN times | RegistryHivesSystem, EventLogs, Amcache, USBDevicesLogs |
| Registry hives | C:\Windows\System32\config\ | System configuration, persistence, accounts and per-user activity, with key write timesKey LastWrite as FILETIME, UTC (per key, not per value); timestamps inside value data vary per artifact, some in local time | RegistryHives, RegistryHivesSystem, RegistryHivesUser |
| Run keys and Startup folders | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run | A program was configured to start at logon, for one user or all usersRun key LastWrite and StartupApproved disable time as FILETIME, UTC; Startup folder files $SI/$FN times, UTC | RegistryHivesUser, RegistryHivesSystem, StartupFolders |
| Scheduled Tasks | C:\Windows\System32\Tasks\<TaskName> | A task was registered to run a command, by whom, and when it was created and last ranDynamicInfo creation/last run as FILETIME, UTC; TaskCache key LastWrite, UTC; XML RegistrationInfo Date in ISO 8601, often no zone | ScheduledTasks, RegistryHivesSystem, EventLogs |
| Windows Services | SYSTEM\ControlSet00x\Services\<ServiceName> | A service or driver was installed to run a binary, its account and start modeService key LastWrite as FILETIME, UTC; System 7045/7036 and Security 4697 TimeCreated in EVTX, UTC | RegistryHivesSystem, EventLogs |
| WMI repository and SCCM RecentlyUsedApps | C:\Windows\System32\wbem\Repository\OBJECTS.DATA | Fileless WMI persistence was registered; on SCCM clients, which programs ran and by whomNo creation time on subscription objects; repository $SI times (NTFS, UTC); CCM LastUsedTime as CIM DATETIME with UTC offset | WBEM, MOF, EventLogs |
File & folder access
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| $I30 index attributes | <directory>\$I30 ($INDEX_ALLOCATION stream of each NTFS folder) | A file name existed in a folder, with sizes and timestamps, even after deletionFour FILETIME values (UTC) per entry, usually mirroring $SI; slack entries keep the times of their last write; no time per INDX record | — |
| $LogFile (NTFS transaction log) | C:\$LogFile | Very recent file-system metadata changes: creates, renames, deletes, $SI updatesNo time per log record; embedded $SI/$FN values as FILETIME, UTC; LSN order gives the sequence | $LogFile |
| $Secure:$SDS security descriptors | C:\$Secure:$SDS | Which account owns a file and what permissions (ACL) applied to itNone in $SDS; date permission changes with the file $SI record-change time and USN SECURITY_CHANGE records, UTC | $SDS |
| Jump Lists | C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\ | Which application a user opened a file with, when last, and (Win10+) how oftenDestList last access per entry as FILETIME, UTC; embedded LNK target times; Jump List file NTFS creation/modification times | JumpLists, LNKFilesAndJumpLists |
| LNK shortcut files | C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\*.lnk | A user opened a specific file or folder, from which volume or share, and whenLNK NTFS creation/modification (first/last open by file name), UTC; target MAC times as FILETIME, UTC; shell item DOS times | LNKFilesAndJumpLists, RecentFolders |
| Master File Table ($MFT) | C:\$MFT | A file or folder existed at a path, with its sizes, timestamps and (often) deletion$SI and $FN each hold four FILETIME values (MACB), UTC, 100 ns resolution; access time may be disabled or delayed up to 1 hour | $MFT |
| Mounted Disk Images (ISO, IMG, VHD, VHDX) | C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx | A disk image file was mounted as a volume, when, under which drive letter, and which files on it were opened or executedVHDMP and Partition event times (UTC), MountedDevices and MountPoints2 key LastWrite (FILETIME, UTC), LNK and Jump List target and volume data (UTC) | EventLogs, RegistryHivesSystem, RegistryHivesUser, LNKFilesAndJumpLists |
| Office MRU and Trust Records | NTUSER.DAT\Software\Microsoft\Office\<version>\<App>\File MRU | A user opened Office documents (with times) and enabled editing or macros on someFile MRU [T...] last open time as hex FILETIME, UTC; TrustRecords first 8 bytes as FILETIME, UTC; key LastWrite | RegistryHivesUser |
| OneDrive sync client | C:\Users\<user>\AppData\Local\Microsoft\OneDrive\ | Which cloud account was linked and which files synced, uploaded or deletedSync DB lastChange and SafeDelete notificationTime as Unix epoch, UTC; ODL log entry times; account key LastWrite as FILETIME, UTC | OneDrive_Metadata, CloudStorage_OneDriveExplorer |
| OpenSaveMRU and LastVisitedMRU | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32 | A user picked a file in an Open/Save dialog, and which program used which folderSubkey LastWrite as FILETIME, UTC, dating only the newest entry of each list; shell items hold DOS date/time of the item itself | RegistryHivesUser |
| Print spooler files (.SPL and .SHD) | C:\Windows\System32\spool\PRINTERS\*.SPL, *.SHD | A document was printed (or queued), by which user, to which printer, and what it looked likeSHD job submission time (SYSTEMTIME, generally UTC but verify), NTFS times of the spool files, event 307 record time in UTC | — |
| RecentDocs | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs | A user recently opened files and folders with these names, in this orderKey and extension subkey LastWrite as FILETIME, UTC, dating only the newest entry of each list; other entries undated | RegistryHivesUser |
| ShellBags | UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\BagMRU | A user browsed a folder (local, USB, network, ZIP), even if it no longer existsBagMRU key LastWrite as FILETIME, UTC (newest child only); shell items hold the folder's DOS date/time, 2-second resolution | RegistryHivesUser |
| Thumbcache | C:\Users\<user>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db | An image, video or document existed and was displayed as a thumbnail for this userNo per-entry timestamps (Windows 7+); only the database $SI modification time, NTFS, UTC | ThumbCache |
| USN Journal ($UsnJrnl:$J) | C:\$Extend\$UsnJrnl:$J | When a file was created, renamed, written, deleted or had its attributes changedPer-record TimeStamp as FILETIME, UTC; BASIC_INFO_CHANGE records give the real time of timestomping | $J |
| Windows Search index | C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb | Files, e-mails and URLs existed in indexed locations, with metadata and partial contentGather time and indexed created/modified/accessed times as FILETIME, UTC; they reflect crawl time, not user activity | WindowsIndexSearch |
| Zone.Identifier (Mark of the Web) | <file>:Zone.Identifier (NTFS alternate data stream) | A file came from the internet or another zone, often with the page and URL it came fromNo date in the stream; date it with the host file $SI/$FN creation times and USN records, UTC | $MFT |
USB & external devices
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| Bluetooth paired devices | SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices\<MAC> | Which Bluetooth devices were paired with the computer, their names and MAC addresses, and roughly when they were last seenKey LastWrite times plus, on some builds, LastSeen/LastConnected REG_QWORD values, all FILETIME in UTC | KAPE: RegistryHivesSystem, EventLogs |
| USB device history | SYSTEM\CurrentControlSet\Enum\USBSTOR | Which USB storage devices were connected, when first and last, and by which userProperties 0064 to 0067 and MountPoints2 LastWrite as FILETIME, UTC; setupapi.dev.log in local time; event logs in UTC | RegistryHivesSystem, RegistryHivesUser, USBDevicesLogs, EventLogs |
Network & remote access
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| Browser artifacts (Chrome, Edge, Firefox) | C:\Users\<user>\AppData\Local\Google\Chrome\User Data\<Profile>\History | Which URLs a user visited, searched and downloaded from, and whenAll UTC: Chromium WebKit time (microseconds since 1601), Firefox PRTime (microseconds since 1970), WebCacheV01.dat FILETIME | WebBrowsers, BrowserCache |
| Desktop messaging apps (Slack, Signal, WhatsApp…) | C:\Users\<user>\AppData\Roaming\<App>\ (Slack, Signal, discord, Telegram Desktop) | A messaging account was used on this PC, with cached messages, contacts and filesPer app, all UTC: Slack ts (epoch seconds), Signal epoch milliseconds, Discord snowflake IDs and ISO 8601; cache file NTFS times | Slack, Signal, WhatsApp, WhatsApp_Media, Telegram, Discord |
| IIS Web Server Logs | C:\inetpub\logs\LogFiles\W3SVC<siteID>\u_exYYMMDD.log | Which client IP requested which URL, with method, status code and user agent, per IIS sitedate and time columns in UTC by default (W3C format), one file per day | IISLogFiles |
| Microsoft Teams (classic and new client) | C:\Users\<user>\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ | Chats, calls, meetings and file shares cached by the Teams client for a usercomposeTime and originalArrivalTime as ISO 8601, UTC; call start/end in UTC; log line times whose time zone varies by format | MicrosoftTeams |
| Network profiles (NetworkList) | SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles | Which networks (SSID, domain, gateway MAC) the host joined, first and last connectionDateCreated and DateLastConnected as 16-byte SYSTEMTIME in local time; profile key LastWrite as FILETIME, UTC; WLAN events UTC | RegistryHivesSystem, EventLogs |
| OpenSSH Server and Client | C:\Windows\System32\winevt\Logs\OpenSSH%4Operational.evtx | Accepted and failed SSH logons (user, source IP, auth method) and keys that grant persistent SSH accessEvent TimeCreated in UTC; file system times of authorized_keys and known_hosts in UTC (NTFS) | — |
| RDP bitmap cache | %LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\ | Fragments of what a user saw on remote screens during RDP sessions from this hostNo per-tile time; cache file $SI created/modified (NTFS, UTC) approximate sessions; date them with RDPClient events 1024/1102 | RDPCache |
| RDP connection artifacts | C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-*.evtx | Who connected over RDP, from which IP, when, and which hosts a user connected toEvent SystemTime in UTC; client Servers and Default key LastWrite as FILETIME, UTC; Default.rdp $SI modification, UTC | EventLogs-RDP, RegistryHivesUser |
| Remote access tools (RMM) | %ProgramData%\AnyDesk\ (and per-tool equivalents) | That a remote-access tool ran, with connection times, peer IDs and remote IP addressesLog entries are per-tool text lines, usually local time (some UTC); file $SI times in NTFS UTC | — |
| Windows Firewall Logs | C:\Windows\System32\LogFiles\Firewall\pfirewall.log | Allowed or dropped connections (if logging is on) and when firewall rules or profiles were changedpfirewall.log date/time columns in local time; event logs in UTC (FILETIME precision) | WindowsFirewall, EventLogs |
User activity
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| CapabilityAccessManager (camera, mic, location) | SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore | Which program used the webcam, microphone or location, from when to whenLastUsedTimeStart and LastUsedTimeStop per app as FILETIME, UTC (latest session only); Windows 11 database usage records | CapabilityAccessManager, RegistryHivesSystem, RegistryHivesUser |
| Clipboard history | C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<id>\ActivitiesCache.db | Text a user copied, from which app and when, if cloud clipboard sync was onCloud clipboard StartTime, ExpirationTime, LastModifiedTime as Unix epoch seconds, UTC; pinned items dated by metadata.json and folder times | WindowsTimeline |
| DPAPI and Credential Manager | %APPDATA%\Microsoft\Protect\<SID>\ | Which secrets a user stored (RDP, browser, Wi-Fi, app creds) and, offline, their plaintextBlob and master-key file $SI/$FN times (NTFS, UTC); master-key GUID files carry an internal modification time | — |
| Notepad TabState (Windows 11) | C:\Users\<user>\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState\*.bin | Text a user typed or pasted into Notepad, including content that was never saved, and which files were openSaved-file tabs embed the file's last write time (FILETIME, UTC, stored in a variable-length encoding per community research); .bin NTFS times in UTC | — |
| Notification database (wpndatabase.db) | C:\Users\<user>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db | Which app showed which notification text to the user, and when it arrivedArrivalTime and ExpiryTime per notification as FILETIME, UTC; push channel and handler times; legacy appdb.dat header time | WindowsNotificationsDB |
| NTDS.dit and domain controllers | C:\Windows\NTDS\ntds.dit | Domain accounts, group membership, password history and (offline) every domain hashAD attributes (pwdLastSet, lastLogonTimestamp) in FILETIME UTC; replication caveats; ESENT log times in the Application log | — |
| Outlook data files (PST and OST) | C:\Users\<user>\AppData\Local\Microsoft\Outlook\*.ost | Which emails and attachments a user received, sent, opened or deleted, and whenMAPI message properties (submit, delivery, creation, modification) as FILETIME in UTC; header Date fields carry the sender's offset | KAPE: OutlookPSTOST |
| SAM hive and user accounts | C:\Windows\System32\config\SAM | Which local accounts exist, when they logged on and changed passwords, and group membershipLast logon, password last set and last failed logon as FILETIME, UTC in the F value; Users and Names key LastWrite, UTC | RegistryHivesSystem |
| Sticky Notes (plum.sqlite and StickyNotes.snt) | C:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite | What a user wrote on desktop notes and when each note was created or changedCreatedAt, UpdatedAt and DeletedAt as .NET ticks, UTC (not FILETIME); legacy .snt storage times as FILETIME, UTC | MicrosoftStickyNotes |
| TypedPaths and WordWheelQuery | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths | A user typed a path in Explorer, or searched for a term in ExplorerTypedPaths and WordWheelQuery key LastWrite as FILETIME, UTC, dating only the most recent entry | RegistryHivesUser |
| Windows Recall (Copilot+ PC snapshots) | C:\Users\<user>\AppData\Local\CoreAIPlatform.00\UKP\{GUID}\ukg.db | What was on the user's screen at a given time: app, window title, visible text and a screenshotPer-snapshot capture times in the database (Unix epoch milliseconds in the preview build, UTC); later formats unverified | — |
| Windows Timeline (ActivitiesCache.db) | C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<account>\ActivitiesCache.db | Which apps a user ran and focused, which files and URLs they opened, and for how longStartTime, EndTime, LastModifiedTime and ExpirationTime as Unix epoch seconds, UTC | WindowsTimeline |
Anti-forensics & deletion
| Artifact | Location | Proves | KAPE / Velociraptor |
|---|---|---|---|
| Recycle Bin | C:\$Recycle.Bin\<SID>\$I* | Which user deleted which file, from which path, when, and its sizeDeletion time in $I or INFO2 as FILETIME, UTC; $I creation matches it; $R keeps the original file's $SI times, UTC | RecycleBin, RecycleBin_InfoFiles, RecycleBin_DataFiles |
| Volume Shadow Copies (VSS) | C:\System Volume Information\{GUID}{3808876b-c176-4e48-b7ae-04046e6cc752} | Earlier versions of files, registry hives and logs, and deletion of snapshotsSnapshot creation time as FILETIME, UTC in the catalog (vssadmin shows local time); files inside keep their NTFS UTC times | — |
KAPE / Velociraptor: target names from the KapeFiles and Windows.Triage.Targets repositories.