Module 4 DF

1
Windows Artifact Analysis:

Understanding user profiles:-

Understanding User Profiles in Windows

When Windows OS is installed, it creates a default folder structure to store user and
application data.
The location of user profiles depends on the Windows version:

● Windows XP, 2000, NT:

C:\Documents and Settings\%UserName%
●

● Windows Vista, 7, 8, 10:

C:\Users\%UserName%
●

When a user logs in for the first time, Windows automatically creates a user profile that stores
their personal environment, settings, and preferences.

Types of User Profiles

Type Description Storage/Behavior

Created on first login. All
Local User
changes (like settings or files) Stored on the local hard disk.
Profile
are saved locally.
Network-based profile created Profile syncs between multiple computers
Roaming
by administrators for enterprise on the same network; updates are stored
User Profile
systems. on the server after logoff.
Created by admins to enforce
Mandatory Any changes are discarded when the user
fixed settings. Users cannot
User Profile logs off.
make permanent changes.
Temporary Created if there’s an error
Deleted after logout; changes not saved.
User Profile loading a profile.

🧩 Registry Hive

Each user profile includes a registry hive file called [Link], which stores user-specific
configuration and preferences.
When the user logs in, this hive is mapped to:

HKEY_CURRENT_USER

2
Common Folders in a User Profile

● \Users\<UserName>\Documents
● \Users\<UserName>\Music
● \Users\<UserName>\Pictures
● \Users\<UserName>\Videos

AppData Folder

● Location: C:\Users\<UserName>\AppData (hidden folder)

● Purpose: Stores user-specific application data and settings.

Subfolders:
1. Roaming: Synced across devices (e.g., bookmarks, cookies).
\AppData\Roaming\Microsoft\Windows\
2. Local: PC-specific data (e.g., history, temp files).
\AppData\Local\
3. LocalLow: Low-level or protected mode data (e.g., browser temp files).
\AppData\LocalLow\

Understanding Windows Registry:

Windows Registry
● Definition: The Windows Registry is a Central database storing configuration info
about users, hardware, and software.

● Location: Registry files (called hives) are stored in:

%SystemRoot%\System32\Config
Main Hives:

● SAM: User login info

● SECURITY: Security and password data

● SOFTWARE: Application and Windows settings

● SYSTEM: Hardware and system config

● [Link]:User-specific settings and behavior

3
 ● [Link]: Stores GUI and User Access Control (UAC) configuration

Tools: RegRipper, Eric Zimmerman’s utilities

Artifacts: Account usage, file knowledge, location, program & USB usage, browser activity.

Determining account usage:-

Last login/last password change:-
Identify which user was active on the system and analyze their login behavior.
User Account Info Location
C:\Windows\System32\Config\SAM\Domains\Account\Users
● Contains details like last login, password change, and account creation.

Security Identifier (SID)

Each account has a unique SID (Security Identifier) used internally by Windows.

● The RID (Relative ID) is the last part of the SID.

o 500 Administrator account

o 501 Guest account
o 1001+ User-created accounts
Event Logs
Windows event logs are another major source for identifying account activity.
Location:
C:\Windows\System32\winevt\Logs
Categories of Logs:

● System: OS-related events

● Application: Events generated by installed applications

● Security: Login attempts and authentication records

4
Determining file knowledge:
Exploring the thumb cache:-

 Definition:
The thumbcache is a database that stores thumbnail images automatically created by Windows
Explorer when a user views folders in thumbnail mode. It helps Windows display image
previews faster.
 Location:

C:\Users\<UserName>\AppData\Local\Microsoft\Windows\Explorer
 Purpose in Forensics:

● Helps investigators find evidence that a particular image or file existed on a system.

● However, presence of a thumbnail doesn’t confirm user awareness, since Windows

can create thumbnails automatically without the user opening the file.
Tools Used:

● Thumbcache Viewer (open-source): Used to extract and view thumbnail images.

● ESEDatabaseView: Used to analyze the Windows Search Indexing database

([Link]) to trace the original file related to a thumbnail.

Exploring Microsoft browsers:-

 Microsoft browsers (IE, Edge, File Explorer) record user file and internet activity.

 History and cache data stored in:

C:\Users\<UserName>\AppData\Local\Microsoft\Windows\WebCache\
Analysis Tools:

● Commercial forensic tools can parse this data automatically.

5
 ● Open-source option: Use ESEDatabaseView (by NirSoft) to view the data manually.

Important Table:

● The Containers table contains key artifacts like:

o Timestamp (when file was accessed)

o File path (location on disk)
o File type (PDF, JPEG, HTML, DOCX, etc.)
Helps investigators track user activity and file usage history.

Determining most recently used/recently used:-

Definition:
MRU (Most Recently Used) lists show files that a user has recently opened or accessed. These
records are stored in the [Link] hive of a Windows user profile.
Key MRU Locations in Registry
1. OpenSavePidlMRU
o Path: [Link]\Software\Microsoft\Windows\CurrentVersion\Explorer\
ComDlg32\OpenSavePidlMRU
o Tracks: Last 20 files opened or saved via the Windows Common Dialog
(Open/Save As).
o Purpose: Shows the recent files accessed by applications.
2. RecentDocs: Tracks up to 150 files opened via Windows Explorer.
Subkeys by File Type

● Each file type has its own subkey listing recently opened files:

o .csv recent CSV files

o .docx recent Word documents
o .html recent HTML files
o \Folder recently accessed folders
Cloud Entries: OneDrive, CloudLog indicate cloud storage use.

Looking into the Recycle Bin:-

 Purpose: Acts as a safety layer before permanent deletion.

6
 Location: Hidden folder named $[Link] in the root directory of every disk.

 User Subfolders: Named using the user’s SID (e.g., S-1-5-21...).

 When a file is deleted:

● Two files are created — $R (actual file data) and $I (metadata).

● $I file stores original file path, deletion time, and file size.

 Deleted Folders: Have $R and $I files containing all subdirectories.

 Emptying Recycle Bin: Marks clusters as available; data may still be recoverable until
overwritten.

 Recovery Difficulty: $I file data (in MFT) is hard to recover once reused by NTFS.

Understanding shortcut (LNK) files:-

Understanding Shortcut (LNK) Files – Medium Notes
● LNK files (shortcut files) are used in Windows to create quick links to files, folders, or
applications.

● They help users easily access frequently used documents or programs.

● Forensic investigators find them valuable because they store metadata even if the
original file is deleted.

● Information stored in LNK files includes:

o File MAC times (Modified, Accessed, Created)

o File size
o Original file path
o Volume details (type, serial number, hostname)

● Windows automatically creates a link file each time a file is opened (double-clicked or
via File Open dialog).

● Storage location:

%UserName%\AppData\Roaming\Microsoft\Windows\Recent

● LNK files can be analyzed using forensic tools:

7
 o Commercial tools (e.g., EnCase, X-Ways)
o Open-source tool: LECmd by Eric Zimmerman

● Forensic importance:

o Provides evidence of user activity and file access.

o Links a specific file to a user account, even if the file has been deleted.

● Note: The creation of LNK files can be disabled by the user or system administrator.

● A related artifact that stores similar data is the Jump List.

Deciphering Jump Lists:-

Deciphering JumpLists – Short Notes
● JumpLists were introduced in Windows 7 to show recently or frequently used files from
the taskbar.

● They are similar to the Recent folder but are not cleared when the Recent folder is
deleted.
Storage Locations:
● %UserProfile%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations

● %UserProfile%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

Types of JumpLists:
1. Automatic – Created by the system; records file usage.
2. Custom – Created by applications; records app-specific tasks.
Key Details:
● Files are named using JumpList IDs, e.g., [Link]-ms.

● IDs can be matched using lists like [Link] JumpList IDs.

● Tools to analyze JumpLists:

o Commercial forensic tools

o Open-source: Eric Zimmerman’s JumpList Explorer
Forensic Value:
● Shows which files (PDF, HTML, DOCX, etc.) a user accessed and when.

● Example: Chrome JumpList showing viewed files and timestamps.

8
 ● Helps investigators track user activity and file access history even after Recent history
is cleared.

Opening shellbags:-
● Shellbags store details about folders accessed by a user through the Windows GUI.

● They record folder size, view mode, and location, not specific files opened.

Location:
%UserProfile%\AppData\Local\Microsoft\Windows\[Link]
Purpose:
● Shows folders accessed (local, network, removable, or encrypted).

● Helps investigators confirm user interaction with certain folders or devices.

Tools:
● Commercial forensic tools.

● Open-source: Eric Zimmerman’s Shellbag Explorer and RegRipper.

Forensic Value:
● Reveals when and which folders a user accessed.

● Can identify access to cloud storage (e.g., Google Drive, Box, Dropbox).

● Useful to prove user awareness of folders or locations on a system.

9
Understanding prefetch
Definition
speeds up application startup
by preloading data into RAM.
execution history useful for forensics.
📂 Location
%WINDIR%\Prefetch

📄 File Type
.pf (Prefetch files)

📊 Information Stored

🧰 Tools
WinPrefetchView
(NirSoft)

Forensic Use

Identifying physical locations:

Determining time zones:-

Purpose
system activity timestamps with real-world time of incidents.
Registry Path

Key Fields Found:

● Bias / ActiveTimeBias: Shows the number of minutes offset from GMT (e.g., 300 or 240
minutes).
● TimeZoneKeyName: Displays the current time zone (e.g., Eastern Standard Time).

● [Link]: Time zone resource DLL file.

10
🔹 Tool Used:
RegRipper — extracts time zone data from the registry for analysis.

Exploring network history:-

● Shows which networks (wired/wireless) a user connected to.

● Found in Software hive or XML file at
C:\ProgramData\Microsoft\Wlansvc\Profiles\Interfaces.
● XML contains SSID, authentication type, and connection details.

● Registry path:
SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList.
● Provides MAC address, last connection time, and profile info.

● Tools like RegRipper can extract and display this data.

● WLAN event logs help confirm network connections and locations.

Understanding the WLAN event Log:-

 Windows maintains a WLAN event log that records all wireless connection activities.

 Location of the log file:

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WLAN-
[Link]

 The log contains details such as SSID (network name), MAC address, and date/time of
each connection event.

 Important Event IDs for investigation:

● 11000 – Wireless network association (connection initiated)

● 8001 – Successfully connected to a wireless network
● 8002 – Failed to connect
● 8003 – Disconnected from network
● 6100 – Network diagnostics (found in System log)

11
 Example: Event ID 11000 shows when the system started connecting to a Wi-Fi network
(e.g., “Net 2.4” on March 27, 2018, at 12:15:58 GMT).

 This artifact helps link a device to a physical location if the location of the Wi-Fi network is
known.

Exploring program execution:-

Shows which programs/apps were run by the user or system.
Determining User Assist:-

● The UserAssist key is a key registry artifact for tracking GUI-based program executions.

Location:
[Link]\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist

Key Details:

Key Details:

● Tracks programs launched via the Windows GUI.

● Data is encoded using ROT13, but forensic tools like RegRipper can automatically
decode it.
● Displays:
o Executable path
o Last execution date/time
o Number of executions (shown in parentheses)

Usefulness:

● Helps forensic investigators identify which applications a user accessed and when.
● Useful for determining user activity and intent in digital investigations.

Exploring the Shimcache

The Shimcache, also known as Application Compatibility Cache, is located at:

SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

 Used by Windows to track application compatibility and executed programs.

12
 Stores key info:

● File path
● Modify time ($Standard Information Attribute$)
● Shimcache update time

 Helps confirm if and when a program was executed.

 Acts as supporting evidence along with registry, event logs, and file system artifacts.

The output of tools like RegRipper helps extract and view this data clearly.

RAM Memory Forensic Analysis:

Identifying sources of memory:-

When volatile data (RAM) is not collected during investigation, some alternative sources may
still contain similar information. These sources include:

Hibernation File ([Link]):

● Stores a compressed copy of system RAM when the computer hibernates.

● Found in the root directory of the system drive.
● Last modified timestamp shows when data was written to disk.
● Common file headers: hibr, HIBR, wake, WAKE.
● Must be decompressed before analysis.

Page File ([Link]):

● Used for virtual memory.

● Holds less-used RAM data on disk.
● Located in the root directory of the OS drive.
● May contain valuable fragments of active processes.

Swap File ([Link])

13
 ● Introduced in Windows 8 and later.
● saves suspended app data.
● Frees physical memory by saving app data to disk, restoring it when resumed.

Crash Dumps ([Link])

● Created when the system crashes or shows the Blue Screen of Death (BSoD).
● Contains a snapshot of system memory at crash time.
● Types:
o Complete Dump – all physical memory (rare).
o Kernel Dump – only kernel-mode data.
o Small Dump – basic info about running processes/drivers.

● Registry path for configuration:

SYSTEM\CurrentControlSet\Control\CrashControl\CrashDumpEnabled

Capturing RAM:-
 Goal: To collect volatile memory (RAM) data from a live system for forensic analysis.
 Challenge: Capturing RAM changes the system’s state — may overwrite some data.

According to the Scientific Working Group on Digital Evidence (SWGDE), the following
points should be kept in mind:

● The RAM capture tool will overwrite part of the memory.

● Larger tools overwrite more data.
● Loading a USB device may write drivers into memory and the registry.
● The RAM capture tool might appear in Most Recently Used (MRU) records.
● The process may cause system instability or lockups.

Preparing the capturing device:-

Preparing the Capturing Device (Medium Notes):

14
To successfully capture or image RAM, the following are required:

● A capturing device (e.g., USB drive).

● Access to the target system.
● Administrator privileges to perform memory acquisition.

Before reaching the investigation site, prepare the external device properly:

● Format the storage device as NTFS, not FAT32, to avoid file size limitations (FAT32
cannot handle files larger than 4 GB).
● Ensure sufficient free space for the memory image.

Once the capturing device is ready, suitable RAM acquisition tools can be used to create a raw
forensic image of the system’s memory for analysis.

Exploring RAM capture tools:-

Exploring RAM Capture Tools (Medium Notes):
When capturing system memory (RAM) for forensic analysis, several open-source tools are
available. The goal is to create a raw memory dump with minimal impact on system data.

1. DumpIt
● Developer: Originally by MoonSols, later maintained by Comae.

● Type: Combined Win32dd and Win64dd executable (single file).

● Features:

o Small, fast, and portable.

o Minimal footprint on the system.
o No configuration required — simple to use.

● Steps to Use:

0. Insert USB drive into the target system.

1. Run Command Prompt as Administrator.
2. Navigate to the DumpIt executable on the USB.

15
 3. Execute the command — it displays available memory and drive space.
4. Confirm by typing ‘y’ to begin capture.
5. Wait for completion; dump size equals the system’s installed RAM.

● Note: The external storage device must have space larger than the system RAM.

2. FTK Imager Lite

● Developer: AccessData.

● Type: GUI-based memory capture tool.

● Features:

o Supports both 32-bit and 64-bit Windows.

o Can dump memory and include [Link].
o Can mount and view binary dump files.

● Steps to Use:

0. Insert USB drive into target system.

1. Launch FTK Imager Go to File Capture Memory .

2. Select destination path on external device.
3. Optionally check “Include pagefile”.

4. Click Capture Memory tool saves the dump and confirms success.

● Note: GUI tools like FTK Imager leave a larger footprint compared to command-line
tools like DumpIt.

After Capture
● Always generate a hash value (MD5/SHA1) of the captured memory file to ensure
integrity.

● Perform hashing and analysis on a forensic workstation, not on the suspect’s system, to
avoid altering evidence.

16
Exploring RAM analyzing tools:-

● RAM analysis can be done using open-source or commercial tools based on examiner
preference and budget.
● Purpose: Extract and analyze data from memory dumps.

Open-Source Tools:

1. Bulk Extractor:
o Scans media (disk, file, or directory) and extracts useful information.
o Ignores filesystem structure faster processing.
o Creates histograms of found artifacts.
2. Volatility:
o Powerful open-source framework for memory forensics and malware analysis.
o Supports many OS memory formats.
o Provides multiple plugins for detailed analysis.
3. VOLIX II v2:
o GUI frontend for Volatility.
o Easier to use—supports point-and-click interface.
o Combines commands for faster workflow.

Using Bulk Extractor:-

Using Bulk Extractor – Short Notes:

● Purpose: Extracts useful data (artifacts) from memory dumps quickly.

● Steps:
1. Open Bulk Extractor Select Tools Run bulk_extractor .

17
 2. Choose the memory image file and output directory.
3. Select desired artifact scanners (email, URLs, credit cards, etc.).
4. Click Submit Run to start extraction.
5. After completion, view extracted data in the Bulk Extractor Viewer.
● Output:

oDisplays recovered artifacts like emails, URLs, IPs, and file headers.
oProvides histograms (frequency counts) of found data.
● Key Use:
o Fast tool for identifying valuable evidence (like email addresses or patterns) from
RAM or disk images.

18