Windows Forensic Artifacts

Windows leaves traces of user activity in dozens of hidden locations — the registry, event logs, prefetch files, link files, and more. Knowing where each artifact lives and what it records is the core skill of Windows forensic examination.

4.1Windows Registry

The Windows Registry is the operating system's central configuration database. It is a hierarchical key-value store that records software settings, hardware configuration, user activity, and network history — all in one place. For a forensic examiner, the registry is one of the richest sources of evidence on any Windows machine.

Five root hives:

Forensic goldmines in HKCU:

• Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs — lists recently opened files, grouped by file extension
• Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths — URLs and paths typed directly into Windows Explorer's address bar
• Software\Microsoft\Windows NT\CurrentVersion\Winlogon\LastLoggedOnUser — the username of the last person to log in

USB device history:

The key SYSTEM\CurrentControlSet\Enum\USBSTOR records every USB storage device that has ever been plugged into the machine. For each device the registry stores the device description, manufacturer, serial number, first connection time, and last connection time. This is critical for proving a particular USB drive was connected to a suspect machine.

UserAssist:

The key HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist records every program the user has launched through the Windows GUI — including the run count and the last run timestamp. The program names are ROT-13 encoded (each letter shifted 13 positions in the alphabet) to lightly obscure them, but any forensic tool decodes this instantly. ROT-13 is not encryption — it is a simple substitution that a forensic examiner must recognise and decode.

Registry hive files on disk:

The registry is stored in binary hive files. These are the actual files you image and parse:

• %WINDIR%\System32\config\SYSTEM — system configuration
• %WINDIR%\System32\config\SAM — local account password hashes
• %WINDIR%\System32\config\SOFTWARE — installed software
• %WINDIR%\System32\config\SECURITY — local security policy
• %USERPROFILE%\NTUSER.DAT — the HKCU hive for the current user

Tools: RegRipper (command-line; runs targeted plugins per artifact), Registry Explorer by Eric Zimmermann (GUI; supports bookmarks and full hive browsing).

4.2Event Logs (EVTX)

Windows continuously records security, system, and application events in structured binary log files. These .evtx files live under %WINDIR%\System32\winevt\Logs\ and are one of the first places a forensic examiner looks to reconstruct what happened on a system.

Key log files:

• Security.evtx — authentication events, account changes, privilege use. The most important log for incident response.
• System.evtx — hardware events, service start/stop, system shutdowns.
• Application.evtx — application errors, crashes, and informational messages.

Critical event IDs for FACT:

Logon types (field inside Event 4624):

Clearing logs as an artifact:

Attackers often clear event logs to hide their tracks. This is itself recorded as Event ID 1102 (Security log cleared) or 104 (System log cleared) — the act of covering up leaves its own trace.

Tools: Windows Event Viewer (built-in, GUI), EvtxECmd by Eric Zimmermann (command-line, parses to CSV/JSON), Chainsaw (fast Sigma-rule-based hunting across EVTX files).

4.3Alternate Data Streams (ADS)

NTFS, the file system used by all modern Windows versions, supports a feature called Alternate Data Streams. Every file actually consists of one or more named "streams" of data. The default stream — the one you normally read and write — is called $DATA. But any file can have additional named streams attached to it, and those streams are completely invisible in Windows Explorer.

Syntax for alternate streams:

filename.txt:hiddenstream

The colon separates the base filename from the stream name. You can create a stream with:

echo "hidden content" > document.txt:secret

The file document.txt appears to have its normal size in Explorer. The hidden stream is not counted. The data in the stream is not shown anywhere in the normal UI.

How attackers misuse ADS:

An attacker can embed an entire executable inside an alternate stream of an innocent-looking file. The file appears as 0 bytes (or its original innocent size) in Explorer, but the malware lives in the stream. When executed via wscript.exe document.txt:malware.exe or similar, the payload runs.

Zone.Identifier — a legitimate ADS:

Windows itself uses ADS for the Zone.Identifier stream. Every file downloaded from the internet automatically receives this stream, recording the source URL and the security zone. Zone 3 = Internet Zone, which triggers the "Open File — Security Warning" prompt. SmartScreen also reads this stream. Forensically, examining Zone.Identifier tells you exactly where a file was downloaded from — even if the user has since cleared their browser history.

Detecting ADS:

• dir /r in the Command Prompt — lists all streams alongside each file
• Get-Item -Stream * in PowerShell — shows all streams for a file
• Streams.exe (Sysinternals) — scans a directory tree for all files with ADS
• Forensic tools (FTK, Autopsy, X-Ways) — display ADS natively in the file browser

4.4File Slack & Unallocated Space

File systems allocate disk space in fixed-size units called clusters. NTFS uses a default cluster size of 4 096 bytes (4 KB). Even a file containing just one byte of data occupies a full 4 KB cluster. The space between the end of the file's actual data and the end of its last cluster is wasted from the user's perspective — but it is a treasure from a forensic perspective.

Cluster and sector basics:

• Sector: the smallest physical unit on a disk, typically 512 bytes.
• Cluster: one or more consecutive sectors; the minimum allocation unit in a file system.
• A file of 1 500 bytes in a 4 096-byte-cluster file system occupies one full cluster; 2 596 bytes of that cluster are unused.

Types of file slack:

• RAM slack (also called sector slack): the gap between the logical end of the file and the end of the last sector. The OS pads this area with bytes from RAM when it writes the file — those RAM bytes may contain fragments of previously processed data.
• Drive slack (also called file slack proper): the gap between the end of the last sector of the file and the end of its last cluster. This area is not written by the OS at all — it retains whatever bytes were stored there by a previous file that occupied that cluster.

Unallocated space:

When a file is deleted, its clusters are returned to the pool of "free" space — they are not wiped. Unallocated space consists of all clusters not currently assigned to any active file. It can contain complete or partial files from deleted data. File carving (Chapter 3) specifically targets unallocated space.

$Recycle.Bin:

When a user deletes a file in Windows Explorer, the file moves to the Recycle Bin rather than being immediately erased. The Recycle Bin is implemented as the $Recycle.Bin folder at the root of each drive. For every deleted file the system creates two internal files:

• $I file: stores the original full path, the original filename, the file size, and the exact deletion timestamp.
• $R file: stores the original file content.

Even if the user empties the Recycle Bin, the $I metadata file often leaves remnants in the $MFT that a forensic examiner can parse to determine what was deleted and when.

4.5Prefetch, LNK Files & Jump Lists

Windows maintains several execution and access history artifacts specifically to help the OS run faster. As a side effect, they give forensic examiners detailed records of what files were opened and what programs were run — even after the files or programs themselves have been deleted.

Prefetch files:

Windows Prefetch (C:\Windows\Prefetch\) stores one .pf file for each program that has been launched. Each prefetch file records:

• The full path of the executable
• The number of times the program has been run (run count)
• Up to eight timestamps of the last eight runs
• A list of files and DLLs the program accessed during its last eight runs

Prefetch is enabled by default on HDDs but is often disabled automatically on SSDs in newer Windows versions (because SSDs are already fast at loading). Finding a prefetch file is execution evidence — proof that a specific program ran on this machine.

LNK (shortcut) files:

Every time a file is opened in Windows, the OS silently creates or updates a .lnk shortcut file in %APPDATA%\Microsoft\Windows\Recent\. Each LNK file records:

• The original file's full path
• The volume serial number and drive type (local, removable, network)
• The original file's MAC timestamps (Modified, Accessed, Created) at the time it was accessed

Critically, LNK files survive deletion of the original file. If a document was opened and later deleted, the LNK file in \Recent\ still shows that the file existed and was accessed, along with its original path.

Jump Lists:

Jump Lists are per-application lists of recently opened files and common tasks, accessible by right-clicking a taskbar icon. They are stored in %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\ as OLE compound document files. Each application has its own Jump List file identified by an application ID. Jump Lists persist evidence of file access even after the original file is deleted and even after the user has cleared their "Recent Items" list.

Amcache and ShimCache:

• Amcache (C:\Windows\AppCompat\Programs\Amcache.hve): records the SHA-1 hash of every executed application, its full path, and the first time it was run. Useful for identifying malware even if the malware file has since been deleted — the hash and path remain.
• ShimCache (AppCompatCache, stored in the SYSTEM registry hive): records the path and last modification time of every executable the OS compatibility layer has seen, regardless of user or run context. Does not always mean the program ran — it means Windows examined the file.

Tools by Eric Zimmermann:

• PECmd — parses prefetch files
• LECmd — parses LNK files
• JLECmd — parses Jump Lists