🟦
LSWSec-Defensive
  • LSWSec - Defensive Security Notes
  • General
    • Tool List
  • Threat Intelligence
    • Introduction
    • Threat Actors and APTs
    • Operational Threat Intelligence
    • Tactical Threat Intelligence
    • Strategic Threat Intelligence
    • Malware and Global Campaigns
  • Phishing
    • Introduction
    • Investigating a Phishing Email
    • Analysing
    • Defensive Action
    • Reactive Measures
    • Report Writing
  • Digital Forensics
    • Introduction
    • Digital Evidence and Handling
    • Memory, Pagefile and Hibernation file
    • Digital Evidence Collection
    • Windows Investigation
    • Linux Investigations
    • Volatility
    • Autopsy
    • Windows Commands
      • Network Discovery
      • DHCP
      • DNS
  • SIEM
    • Introduction
    • Logging
    • Correlation
  • Incident Response
    • Introduction
    • Preperation
    • Detection & Analysis
    • Containment, Eradication and Recovery
    • reporting
    • MITRE Att&ck
  • Event Viewer
    • event Summary
    • Event ID: 4648
    • Event ID: 4776
    • Event ID: 4673
    • Event ID: 4625
Powered by GitBook
On this page
  • Program artefacts
  • Internet Browser Artifacts
  1. Digital Forensics

Windows Investigation

Program artefacts

LNK FILES

  • LNK files are used by windows to link one file to another

  • You can collect a lot of data like when the link was created, modified, last accessed, file size and more.

  • LNK files can be found at: C:\Users\$Users$\AppData\Roaming\Microsoft\Windows\recent

  • Use windows file analyzer

Prefetch Files

  • Can provide information about programs including the name of the application, executable file path, when it was last run and when it was installed/created.

  • Can be found at C:\Windows\Prefetch

  • Use prefetch explorer command line

Jump list

  • Using the jump feature we can find two files: automaticDestionation-ms and customDestination-ms

  • These contain information about application pinned to the taskbar

  • Can be found at; C:\Users\% USERNAME%\AppData\ Roaming\Microsoft\Windows\Recent\AutomaticDestinations

C:\Users\%USERNAME%\AppData\ Roaming\Microsoft\Windows\Recent\CustomDestinations

  • Use Jump List Explorer to analyze these files.

Internet Browser Artifacts

  • Cookies

  • Favorites

  • Downloaded Files

  • URLs

  • Searches

  • Cached Web Pages

  • Cached Images

KAPE

  • Choose output destination

  • Choose target browsers

  • Go to the output folder and there should be a lot of information.

Browser History Viewer

  • Run browser history capturer to capture files.

  • Use browser history viewer to view these files

PreviousDigital Evidence CollectionNextLinux Investigations

Last updated 1 year ago