🕵️ Forensic artifacts

• Activities

• Applications

  • Advanced Port/IP Scanner
  • AnyDesk
  • Microsoft Edge (Chromium)
  • Mozilla Filezilla
  • NetExec
  • Notepad++
  • Remote Desktop
  • Sticky Notes
  • Sublime Text
  • TeamViewer
  • Microsoft Windows 10/11 Notifications
  • Microsoft (Windows) Defender
  • Microsoft Windows 11 Notepad

• Files

• Registry

  • HKCU | HKEY_CURRENT_USER (ntuser.dat)
  • SAM | HKEY_LOCAL_MACHINE/SAM
  • SOFTWARE | HKEY_LOCAL_MACHINE/SOFTWARE
  • SYSTEM | HKEY_LOCAL_MACHINE/SYSTEM

📰 Articles

Cyber Triage

• Windows Scheduled Tasks for DFIR Investigations
• NTUSER.DAT Forensics Analysis
• How to Find Evidence of Network Windows Registry
• MUICache: Guide for IT and Investigators
• UserAssist Forensics
• ShimCache and AmCache Forensic Analysis
• Shellbags Forensic Analysis
• How to Investigate RunMRU
• Windows Registry Forensics Cheat Sheet