Windows Artifacts

System and User Information (via Registry)

Artifact	Filesystem Location	Tools or Commands	Operating System Version
System Information	SOFTWARE\Microsoft\Windows NT\CurrentVersion	Registry Explorer
Computer Name	SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName	Registry Explorer
System Last Shutdown Time	SYSTEM\CurrentControlSet\Control\Windows	Registry Explorer
Cloud Account Details	SAM\Domains\Account\Users<RID>\InternetUserName	Registry Explorer
User Accounts	SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	Registry Explorer
Last Login and Password Change	SAM\Domains\Account\Users	Registry Explorer

Application Execution **

Artifact	Filesystem Location	Tools or Commands
Shimcache	SYSTEM\CurrentControlSet\Control\SessionManager\AppCompatCache	RegRipper
Amcache.hve	C:\Windows\AppCompat\Programs\Amcache.hve	Registry Explorer
UserAssist	NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\	Registry Explorer
Win10 Timeline	C:\%USERPROFILE%\AppData\Local\ConnectedDevicesPlatform\L.Administrator\ActivitiesCache.db	WxTCmd.exe
SRUM	C:\Windows\System32\sru\SRUDB.dat	srum-dump
BAM / DAM	SYSTEM\ControlSet001\Services\bam\State\UserSettings\	Registry Explorer
Prefetch, MFT, USNJ	C:\Windows\prefetch	PECmd.exe

File and Folder Opening **

Artifact	Filesystem Location	Tools or Commands
Shellbag	NTUSER.dat\Software\Microsoft\Windows\Shell\Bags	Shellbags Explorer
Open/Save MRU	NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU	Registry Explorer
Shortcut (LNK) Files	%USERPROFILE%\AppData\Roaming\Microsoft\Windows	Office\Recent\	Autopsy
Jumplist	C:\%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations	Jumplist Explorer

Deleted Items and File Existence **

Artifact	Filesystem Location	Tools or Commands
Recycle Bin	C:$Recycle.Bin	Recbin
Thumbcache	%USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer	Thumbcache Viewer
User Typed Paths	NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths	Registry Explorer

Browser Activity **

Artifact	Filesystem Location	Tools or Commands
Browser activity	C:\Users\%user%\AppData\Local\Roaming\BrowserName	DBBrowser

Network Usage **

Artifact	Filesystem Location	Tools or Commands
Network History	SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network*	Registry Explorer
Timezone	SYSTEM\CurrentControlSet\Control\TimeZoneInformation	Registry Explorer
WLAN Event Log	Microsoft-Windows-WLAN-AutoConfig Operational.evtx	Event log viewer

USB Usage **

Artifact	Filesystem Location	Tools or Commands
USB Device Identification	SYSTEM\CurrentControlSet\Enum*	Registry Explorer
Drive Letter and Volume Name	SOFTWARE\Microsoft\Windows Portable Devices\Devices and SYSTEM\MountedDevices	Registry Explorer

AntiVirus Logs **

AntiVirus	Filesystem Location
Avast	C:\ProgramData\Avast Software\
AVG	C:\ProgramData\AVG\Antivirus\
Avira	C:\ProgramData\Avira\Antivirus\LOGFILES\
Bitdefender	C:\Program Files\Bitdefender\

Other Artifacts

Artifact	Filesystem Location	Tools or Commands
Startup folder (user)	C:\%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup	Autopsy
Shadow copy		Shadow Explorer
Hiberfil.sys	C:\	Hibernation Recon
Pagefile.sys	C:\	strings, Unalloc
Anydesk	C:\Users\%user%\AppData\Roaming\AnyDesk* or C:\ProgramData\AnyDesk*	Autopsy
WMI persistence	C:\WINDOWS\system32\wbem\Repository\OBJECTS.DATA	WMI_Forensics
RDP Cache	C:\%USERPROFILE%\AppData/Local/Microsoft/Terminal Server Client/Cache	BMC-Tools