75 artifact cheat sheets
Windows Forensic Artifacts
Cheat sheets for Windows forensic artifacts: where each one lives per Windows version, what it proves, its timestamps, how to collect it and how to parse it.
75 / 75 artifacts
$I30 cheat sheet: NTFS directory indexes ($INDEX_ROOT, $INDEX_ALLOCATION), INDX records, timestamps, slack entries of deleted files and parsers.
<directory>\$I30 ($INDEX_ALLOCATION stream of each NTFS folder)
$LogFile cheat sheet: NTFS metadata journal (MFT record 2), 64 MB default, redo/undo operations, restart area, short retention and parsers.
C:\$LogFile
$Secure:$SDS cheat sheet: NTFS security descriptor store, $SDH and $SII indexes, Security ID in $SI, file owner SID and ACLs, collection and MFTECmd.
C:\$Secure:$SDS
Amcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
C:\Windows\AppCompat\Programs\Amcache.hve
BAM and DAM cheat sheet: SYSTEM hive keys per Windows 10 build, per-user SIDs, last execution FILETIME, seven-day retention and investigation tips.
SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\<SID>
BITS jobs cheat sheet: qmgr0.dat/qmgr1.dat vs qmgr.db (ESE), Bits-Client events 3, 4, 59, 60, SetNotifyCmdLine persistence and BitsParser carving.
C:\ProgramData\Microsoft\Network\Downloader\qmgr.db
Bluetooth devices cheat sheet: BTHPORT paired device keys, MAC addresses and names, LastSeen/LastConnected times, BTHENUM, event logs and fsquirt transfers.
SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices\<MAC>
Browser forensics cheat sheet: Chromium and Firefox profile files, History and places.sqlite tables, WebKit and PRTime timestamps, downloads, cookies, cache.
C:\Users\<user>\AppData\Local\Google\Chrome\User Data\<Profile>\History
CapabilityAccessManager cheat sheet: ConsentStore keys, LastUsedTimeStart and Stop for webcam and microphone use per app, and the Windows 11 SQLite database.
SOFTWARE\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore
Clipboard history cheat sheet: what Windows 10/11 keeps in memory, pinned items on disk, cloud clipboard text in ActivitiesCache.db and the registry settings.
C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<id>\ActivitiesCache.db
Crash dump cheat sheet: MEMORY.DMP and minidump locations, CrashControl dump types, user-mode dumps, LSASS dumping traces and tools to analyse them.
C:\Windows\MEMORY.DMP
Desktop messaging forensics: where Slack, Signal, WhatsApp, Telegram and Discord keep data on Windows, what is encrypted, timestamps and export options.
C:\Users\<user>\AppData\Roaming\<App>\ (Slack, Signal, discord, Telegram Desktop)
DPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.
%APPDATA%\Microsoft\Protect\<SID>\
- Event Trace Logs (ETL files)File / file system
ETL files cheat sheet: what ETW trace logs are, forensically useful .etl files (WDI boot traces, Wifi.etl, DiagTrack), collection, tracerpt and etl-parser.
C:\Windows\System32\LogFiles\WMI\*.etl
Group Policy cheat sheet: SYSVOL policies, Registry.pol, GPP passwords, client-side history and event logs, and how attackers abuse GPO for mass deployment.
%SystemRoot%\System32\GroupPolicy\
hiberfil.sys cheat sheet: what hibernation and Fast Startup save, compression by Windows version, converting it to a raw memory image and what it can reveal.
C:\hiberfil.sys
IFEO and Winlogon cheat sheet: Debugger hijacks, GlobalFlag and SilentProcessExit, sticky keys backdoors, Userinit/Shell, Notify and AppInit_DLLs.
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\<exe>
- IIS Web Server LogsFile / file system
IIS logs cheat sheet: W3C log location per site, UTC timestamps, default fields, HTTPERR, applicationHost.config and how to hunt webshells on Windows servers.
C:\inetpub\logs\LogFiles\W3SVC<siteID>\u_exYYMMDD.log
Installed programs cheat sheet: Uninstall keys, MsiInstaller events 1033/11707, cached MSIs, AppX packages, winget logs and Amcache to date software installs.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Jump Lists cheat sheet: AutomaticDestinations and CustomDestinations, AppIDs, DestList entries with last access, access count and pin status, and JLECmd.
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\
Kernel drivers cheat sheet: driver services (Type 1/2), event 7045, DriverStore, setupapi.dev.log, Amcache and CodeIntegrity logs to hunt BYOVD and rootkits.
C:\Windows\System32\drivers\*.sys
LNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\*.lnk
$MFT cheat sheet: FILE records, $SI vs $FN timestamps, resident data, deleted records, sequence numbers, timestomping checks and MFTECmd parsing.
C:\$MFT
Microsoft Defender forensics: Operational events 1116/1117/5001/5007, MPLog files, DetectionHistory, encrypted quarantine, exclusion keys and tampering traces.
C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-*.log
Microsoft Teams cheat sheet: classic vs new Teams data folders, IndexedDB LevelDB messages and call logs, logs, and Purview or Graph exports as the reference.
C:\Users\<user>\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\
Mounted disk images cheat sheet: ISO/IMG/VHD/VHDX mounts, VHDMP events, MountedDevices, LNK and Jump List traces, Mark-of-the-Web gaps and a detection workflow.
C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx
MUICache cheat sheet: UsrClass.dat and NTUSER.DAT locations, FriendlyAppName and ApplicationCompany values, what they prove and their timestamp limits.
UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
NetworkList cheat sheet: network profiles, SSIDs, gateway MAC addresses, first and last connection times (local time), WLAN profile files and WLAN events.
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles
- Notepad TabState (Windows 11)File / file system
Notepad TabState cheat sheet: Windows 11 Notepad .bin tab files, unsaved text never written to disk, saved file paths, hashes, WindowState and parsing.
C:\Users\<user>\AppData\Local\Packages\Microsoft.WindowsNotepad_8wekyb3d8bbwe\LocalState\TabState\*.bin
Windows notification database cheat sheet: wpndatabase.db tables, toast Payload XML, FILETIME ArrivalTime and ExpiryTime, WAL recovery and legacy appdb.dat.
C:\Users\<user>\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db
NTDS.dit cheat sheet: the Active Directory database, what it proves, theft traces on a DC, and the Kerberos, NTLM and DCSync event IDs investigators need.
C:\Windows\NTDS\ntds.dit
Office MRU and TrustRecords cheat sheet: File MRU and User MRU keys per Office version, the [T…] timestamp, and how to spot documents with macros enabled.
NTUSER.DAT\Software\Microsoft\Office\<version>\<App>\File MRU
- OneDrive sync clientFile / file system
OneDrive cheat sheet: account registry keys, SyncEngineDatabase.db and <CID>.dat metadata, ODL logs, SafeDelete.db, Files On-Demand and how to parse them.
C:\Users\<user>\AppData\Local\Microsoft\OneDrive\
OpenSavePidlMRU and LastVisitedPidlMRU cheat sheet: ComDlg32 keys per Windows version, what the open/save dialog records, timestamps and upload tips.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32
OpenSSH on Windows cheat sheet: sshd event log, sshd_config and host keys, authorized_keys persistence, known_hosts, client traces and reverse tunnels.
C:\Windows\System32\winevt\Logs\OpenSSH%4Operational.evtx
Outlook PST/OST cheat sheet: data file locations, mail and deleted items, the Content.Outlook attachment cache, profile keys, new Outlook and parsing.
C:\Users\<user>\AppData\Local\Microsoft\Outlook\*.ost
pagefile.sys and swapfile.sys cheat sheet: paged-out memory on disk, what can be recovered, ClearPageFileAtShutdown, compression caveats and carving tools.
C:\pagefile.sys
PE file triage cheat sheet: hashes, imphash and Rich header, compile timestamp caveats, sections and entropy, version info, signatures, PDB paths and tools.
Any .exe, .dll, .sys, .scr, .cpl on disk or extracted from memory
PowerShell forensics: 4103/4104 script block logs, 400/403/800 engine events, PSReadLine ConsoleHost_history.txt, transcripts and logging policy keys.
C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx
Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
C:\Windows\Prefetch\<EXE>-<HASH>.pf
Print spool cheat sheet: .SPL and .SHD files in spool\PRINTERS, EMF content recovery, PrintService event 307, printer drivers and PrintNightmare traces.
C:\Windows\System32\spool\PRINTERS\*.SPL, *.SHD
- Program Compatibility Assistant (PCA)File / file system
Program Compatibility Assistant cheat sheet: Windows 11 PcaAppLaunchDic.txt and PcaGeneralDb files, the AppCompatFlags Store key, fields and UTC times.
C:\Windows\appcompat\pca\PcaAppLaunchDic.txt
RDP bitmap cache cheat sheet: bcache*.bmc and Cache*.bin files on the RDP client, what screen tiles reveal, timestamps, and rebuilding screens with bmc-tools.
%LOCALAPPDATA%\Microsoft\Terminal Server Client\Cache\
RDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-*.evtx
RecentDocs cheat sheet: NTUSER.DAT key and per-extension subkeys, MRUListEx order, what the LastWrite time means and how to link entries to LNK files.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
RecentFileCache.bcf cheat sheet: the Windows 7 execution artifact that lists recently run executables, its location, format, limits and how to parse it.
C:\Windows\AppCompat\Programs\RecentFileCache.bcf
Recycle Bin cheat sheet: $Recycle.Bin $I and $R files, $I version 1 vs 2, XP INFO2, deletion time, original path and size, emptying and Shift+Delete traces.
C:\$Recycle.Bin\<SID>\$I*
Registry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
C:\Windows\System32\config\
RMM and remote access tool cheat sheet: AnyDesk, TeamViewer, ScreenConnect and more, their log files, connection IDs, IPs and timestamps, and how to hunt abuse.
%ProgramData%\AnyDesk\ (and per-tool equivalents)
Run keys and Startup folders cheat sheet: Run, RunOnce, Wow6432Node and Policies paths, StartupApproved enabled/disabled bytes, timestamps and pitfalls.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
RunMRU cheat sheet: commands typed in the Windows Run dialog (Win+R) in NTUSER.DAT, MRUList order, the LastWrite time and LOLBin or UNC patterns to hunt.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
SAM hive cheat sheet: local accounts, RIDs, last logon and password change times, logon counts, group membership, ProfileList, and account-related event IDs.
C:\Windows\System32\config\SAM
Scheduled tasks cheat sheet: task XML and .job files, TaskCache registry keys, DynamicInfo times, hidden tasks, TaskScheduler and 4698 events.
C:\Windows\System32\Tasks\<TaskName>
ShellBags cheat sheet: BagMRU and Bags keys in UsrClass.dat and NTUSER.DAT, shell items, folder timestamps, deleted and USB folders, and parsing with SBECmd.
UsrClass.dat\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
ShimCache (AppCompatCache) cheat sheet: SYSTEM hive location, entry limits per Windows version, ordering, timestamp meaning and execution caveats.
SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
SRUM cheat sheet: SRUDB.dat tables and GUIDs, per-app network bytes and CPU time, hourly UTC records, 30 to 60 day retention and ESE repair steps.
C:\Windows\System32\sru\SRUDB.dat
Sticky Notes cheat sheet: plum.sqlite Note table and .NET tick timestamps on Windows 10/11, legacy StickyNotes.snt, WAL recovery, collection and parsing.
C:\Users\<user>\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite
Syscache.hve cheat sheet: the Windows 7 / Server 2008 R2 hive in System Volume Information that links MFT file IDs to SHA-1 hashes, and its limits.
C:\System Volume Information\Syscache.hve
Sysmon cheat sheet: Operational log location, key event IDs, ProcessGuid and hash correlation, config in the registry, tampering signs and parsing tools.
C:\Windows\System32\winevt\Logs\Microsoft-Windows-Sysmon%4Operational.evtx
Thumbcache cheat sheet: thumbcache_*.db files per Windows version, cache IDs, mapping to the Search index, legacy Thumbs.db and thumbnails of deleted files.
C:\Users\<user>\AppData\Local\Microsoft\Windows\Explorer\thumbcache_*.db
TypedPaths and WordWheelQuery cheat sheet: paths typed in the Explorer address bar and Explorer search terms in NTUSER.DAT, order, timestamps and tips.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
USB forensics cheat sheet: USBSTOR and USB keys, serial numbers, first and last connection times, drive letters, volume serials, setupapi.dev.log and event IDs.
SYSTEM\CurrentControlSet\Enum\USBSTOR
UserAssist cheat sheet: NTUSER.DAT GUID keys, ROT13 value names, run count, focus time and last run FILETIME for programs a user launched from Explorer.
NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count
USN journal cheat sheet: $UsnJrnl:$J and $Max, record fields, reason flags, parent references, default size, rollover, fsutil and MFTECmd parsing.
C:\$Extend\$UsnJrnl:$J
- Volume Shadow Copies (VSS)File / file system
Volume Shadow Copies cheat sheet: store files in System Volume Information, copy-on-write blocks, deletion by ransomware, mounting and parsing.
C:\System Volume Information\{GUID}{3808876b-c176-4e48-b7ae-04046e6cc752}
Windows Error Reporting cheat sheet: Report.wer folders, AppPath and SHA-1 fields, Application events 1000/1001/1002, LocalDumps crash dumps and retention.
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\<ReportFolder>\Report.wer
Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
C:\Windows\System32\winevt\Logs\*.evtx
Windows Firewall cheat sheet: pfirewall.log format and defaults, rule change events 2004-2006, WFP audit 5156/5157, rules in the registry and netsh abuse.
C:\Windows\System32\LogFiles\Firewall\pfirewall.log
Windows Recall cheat sheet: CoreAIPlatform snapshot store, ukg.db and ImageStore, OCR text and window titles, VBS encryption, opt-in status and caveats.
C:\Users\<user>\AppData\Local\CoreAIPlatform.00\UKP\{GUID}\ukg.db
Windows Search index cheat sheet: Windows.edb (ESE) and Windows 11 SQLite Windows.db, indexed paths, dates and content, deleted records, esentutl collection.
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb
Windows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.
SYSTEM\ControlSet00x\Services\<ServiceName>
WSL cheat sheet: Lxss registry key, WSL1 rootfs vs WSL2 ext4.vhdx, bash_history inside distros, wsl.exe execution traces, wsl$ share access and evasion.
HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss
Windows Timeline cheat sheet: ActivitiesCache.db and WAL, Activity tables, ActivityType values, focus duration, clipboard, 30-day expiry and Windows 11 status.
C:\Users\<user>\AppData\Local\ConnectedDevicesPlatform\<account>\ActivitiesCache.db
WMI repository cheat sheet: OBJECTS.DATA, event filters, consumers and bindings, WMI-Activity 5857–5861, MOF files and SCCM CCM_RecentlyUsedApps.
C:\Windows\System32\wbem\Repository\OBJECTS.DATA
Zone.Identifier cheat sheet: Mark of the Web ADS, ZoneId 0 to 4, ReferrerUrl and HostUrl per browser, loss and bypass cases, and collection from the $MFT.
<file>:Zone.Identifier (NTFS alternate data stream)