Windows Forensic Artifacts: Registry, Event Logs and Prefetch

The common predefined roots are HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS and HKEY_CURRENT_CONFIG. They are handles or views into registry data, not the names of five physical files. For example, HKCU reflects the current user, while HKCR provides a classes-related view.

An offline image permits examination of particular hive bytes and associated files. Live logical access can also be relevant in an authorised acquisition, but it exposes a running view with its own changes and limitations. Record the source and method rather than declaring one view universally mandatory.

Preserve available matching transaction logs, such as .LOG1 and .LOG2, with the hive. Appropriate replay can produce a more consistent analysis copy, but files and parser behaviour vary. Keep originals, identify whether replay occurred and retain tool/version and error information.

Historical shadow copies or backups may supply earlier hive states when configured, retained and included in scope. Their cadence is not universal. For offline SYSTEM analysis, resolve the applicable ControlSet using the hive’s selection information rather than assume CurrentControlSet is a separately stored historical control set.

Choose registry artefacts for the question, with the OS version and record structure identified. A value, key last-write time and individual embedded timestamp can have different meanings.

Keep USB descriptor identifiers, volume serials, generated instance identifiers and labels on a device separate. Identifiers may be absent, shared, generated or altered. A registry association can support comparison without uniquely identifying one physical device, a connection time or the operator.

Sensitive registry data can also concern services or credential-related settings. Access protections and actual acquisition determine what is available. Preserve scope and confidentiality; a hive’s name does not guarantee recoverable plaintext secrets.

Convert timestamps according to their stored representation and parser output. Retain raw values and the reporting time basis, commonly UTC with an explained local equivalent where useful. Do not apply a time-zone offset twice to data already normalised by a tool.

EVTX files commonly reside beneath %SystemRoot%\System32\winevt\Logs. The channel and provider identify the event family. Event Viewer can open saved logs, while specialised parsers support bulk extraction and correlation; neither one viewer nor one export format is mandatory.

For event 4624, common logon-type meanings include interactive (2), network (3), unlock (7), remote interactive (10) and cached interactive (11). Available source-address and authentication fields vary; a missing or unsuitable address is not a complete network attribution finding.

Logging requires suitable audit or provider settings and retained data. PowerShell script-block records are not a guarantee that every command is available or fully deobfuscated. Sysmon coverage similarly follows actual installation or enablement, configuration and event filters.

Time changes, unexpected restarts and service activity need provider-specific interpretation. A numerical ID such as 1 has different meanings across providers. A clock-adjustment event can reflect normal synchronisation rather than deliberate manipulation. Check neighbouring records, settings and independent time sources.

Prefetch supports Windows performance optimisation. A retained .pf record can include executable-related information, run counts, time fields, volume information and referenced resources, depending on its format and generation conditions.

Use a parser that supports the record version and any compression. Some formats provide several recent run-time slots, including up to eight in relevant versions; those slots are not a guarantee that eight valid events exist. The path-related filename hash is not a cryptographic hash of the executable’s contents.

An authentic, appropriately interpreted Prefetch record can support an execution inference. It does not alone identify the operator, prove that an executable name corresponds to a particular binary or establish what a referenced document’s contents were.

Absence can result from configuration, platform behaviour, retention, deletion or an incomplete collection. Check the actual available settings and files rather than infer a universal SSD or server rule. A referenced path is a useful lead, not proof that all bytes of the file were read or copied.

PECmd can expose supported run-time and resource fields for review. Retain the original file, tool version, warnings and output settings. Compare uncertain fields with the underlying structure and other evidence rather than treat a CSV label as a self-validating fact.

Registry Explorer, RECmd, RegRipper, EvtxECmd and PECmd support different browsing or parsing tasks. KAPE uses target definitions to select data and module definitions to run processing. Verify each actual version and definition; no tool list establishes a nationwide laboratory standard.

A useful workflow begins with source identity and scope, preserves the relevant artefacts and supporting files, then parses them into traceable derivatives. Retain acquisition and processing logs, settings, errors and the relationship of each exported row to its source path or record.

Examination duration depends on data, condition and questions. A six-hour example is not a universal service deadline. A broad collection target can miss a custom application, unusual path or unsupported version; targeted follow-up should address identified gaps.

Keep original raw timestamps and document any normalisation or filtering. If a parser update changes interpretation, preserve the earlier output and explain the revised result rather than silently replacing it. Independent checks are especially useful for a conclusion central to the case.

Hypothetical example: an investigation asks whether a removable drive was associated with a computer and whether customer information was copied to it. Treat device association, program activity and copying as separate propositions.

USB-related registry data may support an association with a reported identifier, while volume records may help interpret a drive-letter mapping. Identify the type and limitations of each serial or instance value before comparing it with a seized item.

UserAssist and Prefetch may support application activity within their own scope. A logon event identifies a recorded account session, not automatically the individual at the keyboard. Reconcile clocks and available session identifiers before ordering the observations.

A referenced export filename does not establish that its content was written to a removable drive. Seek suitable destination files, content comparisons, write-related records or other independent evidence. Report missing sources and alternative explanations.

Consistent findings can strengthen a particular inference, but sources may share the same clock or underlying action and may not be independent. Explain the proposition supported by each finding and avoid turning agreement into a numerical or automatic legal guarantee.