Lab 04 Windows Forensic Artifact Investigation

Mission Overview

Welcome to Lab 04 — Windows Forensic Artifact Investigation.

Windows endpoints contain some of the richest forensic evidence found in enterprise environments.

A single Windows system can provide evidence about:

• user logons

• program execution

• recent files

• USB activity

• services

• scheduled tasks

• Registry changes

• browser activity

• file access

• system startup

• security events

The challenge is not simply collecting artifacts.

The challenge is correlating them.

For example:

User Logon
    ↓
Program Execution
    ↓
File Access
    ↓
USB Connection
    ↓
Scheduled Task
    ↓
Network Activity

When several independent artifacts support the same sequence, your conclusions become much stronger.

Mission Goal: Examine a provided Windows forensic image or artifact set, identify evidence of user activity and program execution, correlate multiple Windows artifacts, reconstruct a preliminary timeline, and produce a Windows Endpoint Forensic Investigation Report.

---

Mission Information

Item	Details
Difficulty	Intermediate
Estimated Time	120–150 minutes
Primary Skill	Windows Forensics
Secondary Skill	Artifact Correlation
Environment	GoHackersCloud Digital Forensics Lab
Evidence Type	Windows forensic image / exported artifacts
Testing Type	Read-Only Examination
Primary Outcome	Windows Forensic Evidence Register
Safety Level	Authorized Training Evidence Only

---

Learning Objectives

By completing this lab, you will be able to:

• identify Windows forensic evidence sources

• locate user profiles

• analyze Windows Event Logs

• identify authentication activity

• examine Registry artifacts

• understand Prefetch evidence

• review Recent Items

• understand LNK shortcut files

• examine Jump Lists

• identify USB/device evidence

• review Windows services

• analyze scheduled tasks

• identify potential program-execution artifacts

• examine filesystem activity

• distinguish evidence presence from proven user action

• correlate multiple artifacts

• construct an evidence-backed Windows activity timeline

• document confidence and limitations

• produce a professional forensic report

---

Windows Forensics Methodology

Use:

User → Authentication → Execution → File Activity → Device Activity → System Change → Timeline → Correlation → Evidence

Conceptually:

Windows Evidence
      │
      ▼
User Identification
      │
      ▼
Authentication
      │
      ▼
Program Execution
      │
      ▼
File Activity
      │
      ▼
Device Activity
      │
      ▼
System Changes
      │
      ▼
Timeline
      │
      ▼
Correlated Conclusion

The central question is:

What does each artifact prove, and what becomes stronger only when several artifacts agree?

---

Part 1 — Confirm Evidence Integrity

Before examining anything, document:

Case ID:

Evidence ID:

Windows Image / Artifact Set:

Expected SHA-256:

Current SHA-256:

Hash Match:

Investigator:

Date:

Start Time:

If working from a forensic image:

sha256sum Windows-Evidence.dd

Use the verified working copy.

Do not analyze the preserved original.

---

Part 2 — Create the Lab Workspace

Create:

Digital-Forensics-Labs/
└── Lab-04/
    ├── Notes/
    ├── Evidence/
    │   ├── Event-Logs/
    │   ├── Registry/
    │   ├── Prefetch/
    │   ├── LNK/
    │   ├── Jump-Lists/
    │   ├── USB/
    │   ├── Services/
    │   ├── Scheduled-Tasks/
    │   └── Filesystem/
    ├── Screenshots/
    ├── Timeline/
    ├── Findings/
    └── Report/

Create:

Lab-04-Windows-Forensics-Journal.md

Suggested structure:

# Lab 04 — Windows Forensic Artifact Investigation

## Mission Objective

## Evidence Information

## Integrity Verification

## Windows Version

## Hostname

## Timezone

## User Profiles

## Authentication Activity

## Event Logs

## Registry

## Prefetch

## Recent Files

## LNK Files

## Jump Lists

## USB / Device Evidence

## Services

## Scheduled Tasks

## Filesystem Activity

## Timeline

## Correlation

## Findings

## Limitations

## Conclusion

---

Part 3 — Identify the Windows Installation

Determine:

Windows Version:

Build:

Architecture:

Hostname:

Timezone:

Possible evidence sources include:

• Registry

• system files

• forensic-tool operating-system identification

• Event Logs

Do not rely on folder names alone if better evidence is available.

---

Part 4 — Identify User Profiles

Review:

C:\Users\

or the equivalent path inside the forensic image.

You may see:

Administrator

Public

Default

lab-user

analyst

Create:

Profile	Path	Relevant	Notes
lab-user	C:\Users\lab-user	Yes	Primary user
Public	C:\Users\Public	Context	Shared profile

A profile directory proves the profile exists.

It does not by itself prove recent interactive use.

---

Part 5 — Build the User Profile Register

For each relevant user, record:

Username:

Profile Path:

SID:
If available

Profile Creation Evidence:

Last-Use Evidence:

Relevant Artifacts:

Potential profile artifacts include:

Desktop

Documents

Downloads

AppData

Recent

NTUSER.DAT

---

Part 6 — Understand the Windows Registry

The Registry stores configuration and activity-related data.

Important hives include:

SYSTEM

SOFTWARE

SAM

SECURITY

NTUSER.DAT

UsrClass.dat

For this lab, focus on interpretation, not credential extraction.

Do not attempt to recover password hashes.

---

Part 7 — Build the Registry Evidence Map

Conceptually:

SYSTEM
   ↓
Machine Configuration

SOFTWARE
   ↓
Installed Software / Configuration

SAM
   ↓
Local Account Information

NTUSER.DAT
   ↓
User-Specific Activity

UsrClass.dat
   ↓
Shell / User Activity

Record which hives are available.

---

Part 8 — Identify the Hostname

The Windows Registry can contain system identity information.

Use the forensic Registry viewer provided in the lab.

Record:

Hostname:

Registry Hive:

Key:

Value:

Confidence:

This supports host attribution.

---

Part 9 — Determine Timezone

Timezone is essential before creating timelines.

Record:

Configured Timezone:

Evidence Source:

UTC Offset:

Daylight Saving Context:

Timeline Standard:
UTC / Local

Do not mix timestamps from different sources without normalization.

---

Part 10 — Examine Windows Event Logs

Common log locations include:

C:\Windows\System32\winevt\Logs\

Important logs include:

Security.evtx

System.evtx

Application.evtx

Additional channels may exist depending on configuration.

Use the provided forensic/event-log viewer.

---

Part 11 — Understand Event Log Value

Windows Event Logs can provide evidence relating to:

• authentication

• system startup

• service activity

• process creation

• account changes

• security controls

• scheduled tasks

• PowerShell

• remote access

Not every event type is enabled in every system.

---

Part 12 — Analyze Logon Activity

Authentication evidence may answer:

Which account authenticated, when, and through what type of logon?

Record:

Time	Account	Event	Source	Result
		Logon	Security	Success
		Logon	Security	Failure

Do not assume all successful logons are interactive keyboard logons.

---

Part 13 — Understand Logon Types

Windows may record different logon categories depending on activity.

Examples can include:

• interactive

• network

• remote interactive

• service

• batch

Your forensic tool may expose the associated logon type.

Record the actual value and interpret it carefully.

---

Part 14 — Build the Authentication Timeline

Create:

08:42 — User logon

08:44 — Application activity

08:48 — File access evidence

09:02 — User logoff

At this stage, use only evidence-backed events.

---

Part 15 — Review Failed Authentication

Look for relevant failed logon activity within the investigation window.

Record:

Account:

Time:

Source:

Failure Reason:

Repeated:

Security Relevance:

A few failures may be normal.

Do not automatically interpret them as attack activity.

---

Part 16 — Investigate Prefetch

Windows Prefetch may provide evidence that an executable was run.

Common location:

C:\Windows\Prefetch\

Files may resemble:

NOTEPAD.EXE-XXXXXXXX.pf

CHROME.EXE-XXXXXXXX.pf

Prefetch availability depends on Windows version and configuration.

---

Part 17 — Understand What Prefetch Can Support

Prefetch can help establish:

Executable Name

Execution Evidence

Execution Count
Where supported

Last Execution Times
Where supported

Referenced Files
Depending on parser

The exact fields depend on operating-system version and tool support.

---

Part 18 — Avoid Overclaiming Prefetch

Good:

Prefetch evidence indicates that APP.EXE was executed on the system.

Avoid:

The user intentionally launched the application.

Prefetch usually does not independently prove which person initiated execution.

---

Part 19 — Build the Prefetch Register

Executable	Last Run	Run Count	User Attribution	Relevance
			Unknown

Correlate execution with user-logon and other evidence.

---

Part 20 — Review Recent Items

User profiles may contain evidence of recently accessed files.

Examples may include:

Recent Items

LNK shortcuts

Jump Lists

These artifacts can provide context around files and applications.

---

Part 21 — Understand LNK Files

Windows shortcut files can contain information such as:

Target Path

Original Location

Volume Information

Timestamps

Drive Information

depending on the shortcut.

A shortcut can remain after the target file is moved or deleted.

This makes LNK files valuable forensic evidence.

---

Part 22 — Build the LNK Evidence Register

LNK	Target	Original Path	Timestamp	Relevance

Record exact parser output.

---

Part 23 — Correlate LNK with Deleted Files

Suppose Lab 03 found:

Deleted:
C:\Users\lab-user\Downloads\report.docx

Lab 04 may reveal an LNK file referencing:

C:\Users\lab-user\Downloads\report.docx

Now you have corroborating evidence.

Conceptually:

Deleted File Artifact
        +
LNK Reference
        =
Stronger Evidence of Prior File Presence

Still avoid claiming exactly who opened it unless supported.

---

Part 24 — Investigate Jump Lists

Jump Lists may track application-associated recent or frequent items.

They can help connect:

Application
     ↓
Recent File
     ↓
File Path

Availability and interpretation vary across Windows versions.

---

Part 25 — Build the Jump List Register

Application	Referenced File	Path	Timestamp	Relevance

Use Jump Lists as corroborating evidence.

---

Part 26 — Investigate RecentDocs

Registry-based user artifacts can sometimes record recently accessed filenames or categories.

Review with a forensic Registry parser.

Record:

User:

Artifact:

Referenced Filename:

Timestamp:
If independently available

Investigative Relevance:

Do not assume a Registry entry itself provides an exact access timestamp unless the artifact actually contains one.

---

Part 27 — Examine UserAssist Conceptually

UserAssist artifacts can provide evidence related to GUI-based program usage.

Potentially useful information may include:

• executable references

• run counts

• timestamps

Interpret the data using a trusted forensic parser.

---

Part 28 — Build the Program Execution Evidence Matrix

Combine:

Application	Prefetch	UserAssist	Event Log	Confidence
App01	Yes	Yes	Yes	High
App02	Yes	No	No	Medium

Multiple independent artifacts increase confidence.

---

Part 29 — Understand Amcache

Amcache can provide information about programs/files known to the system.

It may help identify:

• executable paths

• metadata

• application information

But:

Presence in Amcache does not always prove execution.

Treat it as contextual or supporting evidence unless the artifact and version support a stronger conclusion.

---

Part 30 — Understand Shimcache / AppCompatCache

Application Compatibility Cache artifacts can provide historical information about executables observed by Windows.

Again:

Presence does not automatically prove program execution.

This is a common forensic interpretation mistake.

Use appropriate confidence language.

---

Part 31 — Create the Execution Artifact Comparison

Artifact	Can Indicate	Does Not Necessarily Prove
Prefetch	Execution	Specific user action
UserAssist	GUI program usage	Malicious intent
Amcache	Program/file presence	Execution in all cases
Shimcache	Historical executable presence	Execution
Event Log	Logged process activity	Activity not audited

This table is worth remembering.

---

Part 32 — Review Download-Related Filesystem Evidence

Examine:

C:\Users\<user>\Downloads\

Look for case-relevant training artifacts.

Record:

Filename:

Path:

Created:

Modified:

File Type:

Hash:

Status:
Existing / Deleted

Correlate with Lab 03.

---

Part 33 — Review Desktop and Documents

Relevant files may appear under:

Desktop

Documents

Compare:

• names

• timestamps

• hashes

• shortcut references

• recent-item artifacts

Do not collect unrelated private files.

---

Part 34 — Investigate USB / Device Artifacts

Windows may retain evidence relating to connected USB storage devices.

Potential evidence sources include Registry data and setup logs.

Depending on available artifacts, you may identify:

Device Identifier

Vendor

Product

Serial Number

Connection Evidence

Do not assume every USB device is removable storage.

---

Part 35 — Build the USB Device Register

Device	Identifier	User Context	First/Last Evidence	Relevance

The exact timestamps available depend on artifact type.

---

Part 36 — Correlate USB with File Activity

Suppose:

09:15 — USB connection evidence
09:17 — LNK references E:\project.docx
09:18 — recent file reference

Together, these may support interaction with a file located on removable media.

Do not automatically conclude the file was copied.

For copying, seek additional evidence.

---

Part 37 — Review Windows Services

Services can provide evidence of:

• legitimate applications

• security software

• system functionality

• unusual system changes

Review relevant service configuration.

Record:

Service Name:

Display Name:

Executable Path:

Start Type:

Account:

Evidence Timestamp:

Security Relevance:

---

Part 38 — Build the Service Evidence Register

Service	Executable	Account	Start Type	Expected	Relevance

Do not classify unknown services as malicious without context.

---

Part 39 — Review Service Installation Evidence

Event Logs or Registry data may indicate that a service was installed or modified.

Record:

Time:

Service:

Configuration:

Evidence Source:

Confidence:

Correlate with filesystem and execution evidence.

---

Part 40 — Investigate Scheduled Tasks

Scheduled tasks may execute:

• applications

• scripts

• maintenance actions

• update processes

They can also be relevant during incident investigations.

Review task configuration from the forensic evidence.

---

Part 41 — Build the Scheduled Task Register

Task	Run As	Action	Trigger	Expected	Relevance

Do not execute the task.

This is forensic examination.

---

Part 42 — Correlate Task with Filesystem Evidence

Suppose a task references:

C:\Users\Public\update.ps1

Now check whether that file exists in the image.

Record:

Task:

Referenced File:

File Exists:

Hash:

Timestamps:

Other Execution Evidence:

The relationship can be important even without executing anything.

---

Part 43 — Review PowerShell Evidence

Depending on logging configuration, evidence may exist in:

• Event Logs

• PowerShell history

• script files

• execution artifacts

Only analyze available training evidence.

Do not run recovered scripts.

---

Part 44 — Treat Recovered Scripts as Evidence

If you find:

script.ps1

do not execute it.

Instead:

Preserve
   ↓
Hash
   ↓
Read as Evidence
   ↓
Document

The same principle applies to executables and unknown files.

---

Part 45 — Review File Hashes

For important extracted artifacts:

sha256sum extracted-file

Build:

Evidence ID	File	SHA-256	Parent Evidence
WIN-F01			E01-W01

Hashes support derived-evidence integrity.

---

Part 46 — Examine Filesystem Timestamps

For relevant files, record:

Created

Modified

Accessed

Metadata Change
where supported

Be precise about timestamp type.

Do not simplify them all to:

File Time

---

Part 47 — Understand Windows Timestamp Interpretation

File timestamps can change because of:

• creation

• editing

• copying

• extraction

• application behavior

• filesystem behavior

Therefore:

One timestamp should rarely carry an entire forensic conclusion.

---

Part 48 — Build the Windows Artifact Timeline

Combine:

Authentication

Prefetch

LNK

Jump Lists

USB

Services

Scheduled Tasks

Files

Event Logs

Example:

Time	Artifact	Event	Source	Confidence
09:01	lab-user	Logon	Security log	Confirmed
09:08	browser.exe	Execution	Prefetch	Confirmed
09:14	report.docx	Referenced	LNK	Supported
09:30	USB01	Device evidence	Registry	Supported

---

Part 49 — Normalize Timeline Times

Before correlation:

Source Timezone:

Timeline Timezone:

UTC Conversion Applied:
Yes / No

Ensure all events use one standard.

This becomes critical when adding network and server logs later.

---

Part 50 — Build the Artifact Correlation Matrix

Create:

Question	Artifact 1	Artifact 2	Artifact 3	Confidence
Was App X executed?	Prefetch	UserAssist	Event Log	High
Did File Y exist?	Filesystem	LNK	Jump List	High
Was USB connected?	Registry	Setup Log	LNK	High

This is one of the most important deliverables in the lab.

---

Part 51 — Understand Corroboration

One artifact may suggest activity.

Three independent artifacts may strongly support it.

Conceptually:

Artifact A
   +
Artifact B
   +
Artifact C
   =
Stronger Conclusion

But only if they are genuinely independent and interpreted correctly.

---

Part 52 — Separate Fact, Interpretation, and Hypothesis

Fact

Prefetch artifact exists for APP.EXE.

Interpretation

The artifact supports execution of APP.EXE.

Hypothesis

The logged-in user intentionally executed APP.EXE as part of the incident.

The third statement requires more evidence.

---

Part 53 — Build the Investigation Hypothesis Register

Hypothesis	Supporting Evidence	Missing Evidence	Status
User opened document	LNK + Jump List	Direct user attribution	Supported
USB copied document	USB + LNK	Copy evidence	Unconfirmed
Task executed script	Task config	Execution event	Possible

This keeps the investigation honest.

---

Part 54 — Identify Positive Evidence

Do not focus only on suspicious artifacts.

Examples:

Windows Defender enabled

Expected update services present

No unexpected administrative task found

Normal account logon pattern

Expected service configuration

Positive evidence can rule out hypotheses.

---

Part 55 — Example Finding: Program Execution

Finding:
Execution evidence identified for the designated training program.

Evidence:
Prefetch and user-activity artifacts contain references to
TRAININGAPP.EXE within the incident window.

Interpretation:
The available artifacts support execution of the application on
the investigated Windows endpoint.

Limitation:
The artifacts do not independently establish which human user
initiated the execution.

---

Part 56 — Example Observation: USB Device

Observation:
Evidence indicates that the designated training USB device was
connected to the Windows endpoint during the investigation period.

Supporting Evidence:
Relevant device information was identified in Windows forensic
artifacts.

Investigative Relevance:
The connection occurred near the time a shortcut referenced a
file located on removable media.

Limitation:
The evidence does not independently prove that a file was copied
to or from the device.

---

Part 57 — Example Scheduled Task Finding

Finding:
Scheduled task references a case-relevant script.

Observation:
The task configuration specifies the training script as its
execution action.

Correlation:
The referenced script exists in the forensic image and its
filesystem timestamps overlap the investigation window.

Limitation:
The task configuration alone does not prove the task actually
executed during the incident period.

If execution evidence exists, update the conclusion accordingly.

---

Part 58 — Build the Windows Forensic Evidence Register

Create:

ID	Artifact	User/Host	Time	Observation	Confidence
WIN-01	Security Log	lab-user		Logon	Confirmed
WIN-02	Prefetch	Host		Program execution	High
WIN-03	LNK	lab-user		File reference	Supported
WIN-04	USB	Host		Device connection	Supported

Add:

• source path

• evidence ID

• hash where applicable

• follow-up requirement

---

Part 59 — Build the Evidence Lineage

Example:

E01 — Windows Disk Image
        │
        ▼
E01-W01 — Working Copy
        │
        ├── WIN-EVTX-01 — Security Log
        ├── WIN-REG-01 — Registry Hive
        ├── WIN-PF-01 — Prefetch
        ├── WIN-LNK-01 — Shortcut
        └── WIN-TASK-01 — Scheduled Task

Every extracted artifact should remain traceable.

---

Part 60 — Hash Important Extracted Artifacts

For evidence files exported from the forensic image:

sha256sum Security.evtx

and similarly for other key artifacts where appropriate.

Record:

Evidence ID:

Source Evidence:

Original Path:

Export Path:

SHA-256:

Export Time:

Investigator:

---

Part 61 — Reverify Working Evidence

At the end of the lab:

sha256sum Windows-Evidence.dd

Compare:

Pre-Examination Hash:

Post-Examination Hash:

Match:

Integrity Status:

Expected:

Match:
Yes

when working read-only.

---

Part 62 — Mission Challenge

Using the supplied Windows evidence, answer:

CASE INFORMATION

Case ID:

Evidence ID:

Windows Version:

Hostname:

Timezone:


USER ACTIVITY

Primary User Profile:

Relevant SID:

Logon Time:

Logoff Time:

Failed Authentication:

Remote Logon Evidence:


PROGRAM EXECUTION

Application 01:

Prefetch Present:

UserAssist Present:

Event Log Evidence:

Execution Confidence:


Application 02:

Evidence:

Confidence:


FILE ACTIVITY

Relevant File:

Original Path:

LNK Evidence:

Jump List Evidence:

RecentDocs Evidence:

Filesystem Evidence:

Deleted:
Yes / No

Correlation:


USB / DEVICE ACTIVITY

Device:

Identifier:

Connection Evidence:

Relevant Time:

File Relationship:

Confidence:


SYSTEM CHANGES

New/Relevant Service:

Scheduled Task:

Referenced Script/Application:

Execution Evidence:

Security Relevance:


TIMELINE

Earliest Relevant Event:

Event 01:

Event 02:

Event 03:

Event 04:

Latest Relevant Event:


CORRELATION

Strongest Correlation:

Most Important Artifact:

Highest-Confidence Finding:

Largest Evidence Gap:

Unconfirmed Hypothesis:


FINAL CONCLUSION

What Happened:

What Is Confirmed:

What Is Supported:

What Remains Unknown:

Recommended Next Investigation:

---

Part 63 — What Not to Do

Do not:

Modify original Windows evidence

Boot the evidence image normally

Execute recovered programs

Execute recovered PowerShell scripts

Extract password hashes

Dump credentials

Attempt account access

Treat Prefetch as user attribution

Treat Amcache as guaranteed execution

Treat Shimcache as guaranteed execution

Assume USB connection means file copying

Assume task configuration proves task execution

Change evidence timestamps

Collect unrelated personal information

Ignore timezone differences

Present hypotheses as facts

The principle is:

Parse → Correlate → Qualify → Conclude

---

Part 64 — Troubleshooting

Prefetch Directory Is Empty

Possible reasons include:

• feature disabled

• cleanup

• Windows version/configuration

• artifact not included in evidence set

Record the absence.

Do not infer that no applications executed.

Security Log Has Few Events

Audit configuration may have been limited.

Use other artifacts.

Absence of logging is not proof that activity did not occur.

LNK Target No Longer Exists

That may be valuable.

A shortcut can remain after the underlying file is deleted or moved.

Correlate with Lab 03.

Registry Parser Gives Different Times

Check:

• timestamp semantics

• timezone conversion

• parser version

• source hive

• artifact interpretation

Document the method used.

USB Evidence Exists but No File Evidence

Do not infer copying.

Record only device connection evidence.

Scheduled Task Exists but No Execution Event Exists

Classify:

Task Exists:
Confirmed

Task Executed:
Unconfirmed

---

Evidence Requirements

Capture:

Evidence 01

Working-image integrity verification.

Evidence 02

Windows version and hostname.

Evidence 03

Timezone evidence.

Evidence 04

User Profile Register.

Evidence 05

Authentication timeline.

Evidence 06

Relevant Security Event Log evidence.

Evidence 07

Registry artifact evidence.

Evidence 08

Prefetch Register.

Evidence 09

LNK evidence.

Evidence 10

Jump List evidence.

Evidence 11

Recent-file evidence.

Evidence 12

Program Execution Evidence Matrix.

Evidence 13

USB Device Register.

Evidence 14

Service Evidence Register.

Evidence 15

Scheduled Task Register.

Evidence 16

Relevant filesystem evidence.

Evidence 17

Windows Artifact Timeline.

Evidence 18

Artifact Correlation Matrix.

Evidence 19

Hypothesis Register.

Evidence 20

Windows Forensic Evidence Register.

Evidence 21

Evidence lineage.

Evidence 22

Post-examination hash verification.

---

Mission Deliverables

Complete:

• evidence integrity verified

• Windows version identified

• hostname identified

• timezone documented

• user profiles identified

• User Profile Register created

• Event Logs examined

• authentication activity reconstructed

• Registry evidence reviewed

• Prefetch analyzed

• Recent Items reviewed

• LNK artifacts analyzed

• Jump Lists reviewed

• program-execution evidence correlated

• USB/device evidence reviewed

• services examined

• scheduled tasks examined

• relevant filesystem evidence correlated

• timeline normalized

• Windows Artifact Timeline created

• Artifact Correlation Matrix created

• facts separated from hypotheses

• positive evidence documented

• Windows Forensic Evidence Register completed

• evidence lineage maintained

• extracted evidence hashed where appropriate

• working evidence reverified

• final report completed

---

Lab Report Template

# Lab 04 — Windows Forensic Artifact Investigation

## Executive Summary

## Mission Objective

## Case Information

## Evidence Information

## Integrity Verification

## Windows System Profile

### Windows Version
### Hostname
### Timezone

## User Profiles

## Authentication Analysis

## Windows Event Log Analysis

## Registry Analysis

## Program Execution Analysis

### Prefetch
### UserAssist
### Amcache
### Shimcache

## Recent File Analysis

### Recent Items
### LNK Files
### Jump Lists
### RecentDocs

## USB / Device Analysis

## Service Analysis

## Scheduled Task Analysis

## Filesystem Analysis

## Evidence Correlation

## Windows Artifact Timeline

## Investigation Hypotheses

## Positive Evidence

## Windows Forensic Evidence Register

## Findings

## Limitations

## Recommended Follow-Up

## Conclusion

## Appendix A — Evidence Index

## Appendix B — Timeline

## Appendix C — Hashes

## Appendix D — Evidence Lineage

---

Knowledge Check

Question 1 — Why are Windows forensic artifacts valuable?

Because Windows stores many independent traces of user, application, device, authentication, and system activity that can be correlated.

Question 2 — Does a user profile directory prove that the user recently logged on?

No.

Additional authentication or activity evidence is needed.

Question 3 — What can Prefetch commonly support?

Evidence that a particular executable was run, subject to Windows version and configuration.

Question 4 — Does Prefetch alone identify the human who executed a program?

No.

User attribution requires correlation.

Question 5 — Why are LNK files useful?

They can retain references to files and paths even when the original file has been moved or deleted.

Question 6 — Does Amcache always prove program execution?

No.

Interpretation depends on the artifact, operating-system version, and available supporting evidence.

Question 7 — Does a USB connection prove data was copied?

No.

It proves device-related activity when properly supported by the artifact. File-transfer conclusions require additional evidence.

Question 8 — Does a scheduled task configuration prove execution?

No.

Execution should be supported by additional task, log, process, or filesystem evidence.

Question 9 — Why normalize timezone information?

So artifacts from different evidence sources can be accurately correlated in one timeline.

Question 10 — What makes a Windows forensic conclusion strong?

Multiple correctly interpreted, independent artifacts supporting the same conclusion.

---

Skills Achieved

After completing this lab, you should understand:

• Windows forensic image examination

• Windows system identification

• Windows user profiles

• Event Log analysis

• authentication forensics

• Registry artifact analysis

• Prefetch

• UserAssist concepts

• Amcache concepts

• Shimcache concepts

• LNK files

• Jump Lists

• RecentDocs

• USB/device artifacts

• Windows services

• scheduled tasks

• filesystem evidence

• program-execution correlation

• timestamp normalization

• Windows timeline construction

• evidence correlation

• hypothesis management

• evidence lineage

• professional Windows forensic reporting

---

Professional Takeaway

Windows forensics should never depend on a single artifact.

Instead, think:

Logon Evidence
      +
Prefetch
      +
Registry
      +
LNK
      +
Jump List
      +
Filesystem
      +
Device Evidence
      =
Much Stronger Investigation

The key professional distinction is:

Artifact presence is not always the same as user action.

For example:

Executable Present
      ≠
Executable Executed

and:

USB Connected
      ≠
File Copied

and:

Scheduled Task Exists
      ≠
Scheduled Task Ran

Your job is to connect independent evidence until the conclusion becomes defensible.

User → Authentication → Execution → File → Device → System Change → Timeline → Correlation

That is the core Windows forensic workflow.

What’s Next?

➡️ Lab 05 — Linux Forensic Investigation

In the next lab, you will investigate a Linux system using evidence from:

• /var/log

• authentication logs

• users and groups

• sudo activity

• SSH

• shell history

• cron

• systemd

• services

• filesystem metadata

• configuration files

• user home directories

• application logs

The methodology becomes:

Identity → Authentication → Command Activity → Privilege → Process/Service → File Activity → Logs → Timeline → Evidence

By the end of Lab 05, you should be able to answer:

“Which accounts were active on the Linux system, what relevant activity occurred, which services and scheduled actions were involved, and what sequence of events is supported by the available forensic evidence?”