Windows Forensics

Windows systems leave extensive forensic artifacts. Event logs record user activity, the registry stores configuration and malware persistence, and MFT reveals file access patterns. Eric Zimmerman's tools are essential.

Critical Windows Artifacts

Each family below answers a different question, and each is parsed by dedicated tooling rather than by reading the binary by hand. Work them in the order that matches your investigation question — not in the order they are listed here — and record the parse tool and version for every export.

Event Logs

The Security, System and Application logs answer who authenticated and what executed. The five event IDs below carry most of a Windows intrusion narrative; parse the whole .evtx file rather than filtering in Event Viewer, because the export is what becomes evidence.

# Event Logs (Security, System, Application)
# Location: C:\Windows\System32\winevt\Logs\

EvtxECmd.exe -f Security.evtx --csv output --csvf security.csv

# Key Event IDs:
# 4624 - Successful logon
# 4625 - Failed logon
# 4672 - Special privileges assigned (admin)
# 4688 - Process creation
# 4720 - User account created

Registry Hives

Hives answer how the machine is configured and what the user actually did. Parse them from the image, never from the running system: RegRipper and RECmd both read a mounted hive file offline, which is the only way to get a defensible result.

# Registry Hives
# SYSTEM: C:\Windows\System32\config\SYSTEM
# SOFTWARE: C:\Windows\System32\config\SOFTWARE
# SAM: C:\Windows\System32\config\SAM
# NTUSER.DAT: C:\Users\<user>\NTUSER.DAT

# Parse with RegRipper
rip.exe -r NTUSER.DAT -p userassist

Prefetch

Prefetch answers which executables ran, from which path, and how many times. It exists on workstation editions; on Windows Server it is disabled by default, so its absence on a server is expected rather than suspicious.

# Prefetch (program execution history)
# Location: C:\Windows\Prefetch\
PECmd.exe -d C:\Windows\Prefetch --csv output

Master File Table

The MFT answers what files existed, where, and when their timestamps changed — including entries for files that have since been deleted. It is the single most useful file-system artifact on NTFS and the reason $MFT is copied first when you cannot take a full image.

# MFT (Master File Table) - every file on NTFS
MFTECmd.exe -f $MFT --csv output --csvf mft.csv

SRUM

SRUM answers which application moved how many bytes, and for how long. It is the closest thing Windows has to per-process network accounting, and it survives on disk after the connection is long gone. Add the SOFTWARE hive and the export gains user names and Wi-Fi profile names; leave it out and the network tables are still readable, just anonymised to IDs.

# SRUM (System Resource Usage Monitor) - network usage, app runtime
# Location: C:\Windows\System32\sru\SRUDB.dat
SrumECmd.exe -f SRUDB.dat -r SOFTWARE --csv output

A copy taken from a running host is normally dirty, because the database's transaction logs were still open. SrumECmd copies the database and its logs aside and replays them on the copy, so the evidence file is never opened in place and no manual esentutl repair is needed.