To run efficiently and make life easier for the user, Windows constantly records information about what happens: which programs are launched, which files are opened, which folders are visited, who logs in and when. These traces, called artifacts, were not designed for investigations, but they are among the richest sources for reconstructing how a computer was used.
The registry
The registry is a large hierarchical database in which Windows and programs store settings and states. It is divided into files called hives: some cover the whole system, others the individual user. The user profile file, NTUSER.DAT, is particularly interesting because it describes that person's habits.
Useful information that can be found includes:
- installed programs and installation dates;
- recently opened documents, grouped by file type;
- commands typed into the Run dialog;
- paths typed into File Explorer's address bar;
- Wi-Fi networks the computer connected to;
- user accounts present, with creation date and last login.
Many registry keys also record a last-write time, which shows when that entry was last changed.
Prefetch
To speed up program start-up, Windows creates a file in the Prefetch folder for each executable launched. Each file contains the program name, the number of executions and the dates of the most recent runs, up to eight in recent versions.
In an investigation, Prefetch can prove that a program was run even if it has since been deleted. It is useful, for example, to identify the use of secure-deletion programs or unauthorised tools. Bear in mind that on some configurations, particularly certain servers, Prefetch may be disabled.
Event logs
Windows event logs, files with the .evtx extension, keep a history of what happens on the system. Some events are particularly relevant:
| Area | What it records |
|---|---|
| Logons | Successful and failed logons, logon type (local, remote, network) |
| System | Start-ups, shutdowns, time changes, service errors |
| Services | Installation of new services, often used by malicious programs |
| Remote Desktop | Remote connections and disconnections |
| PowerShell | Commands and script execution, if logging is enabled |
Each event is identified by a number; knowing the most significant ones lets you filter thousands of lines quickly. Keep in mind, however, that logs have a maximum size and the oldest entries are overwritten, and that clearing them generates a specific event of its own.
LNK files and Jump Lists
When you open a file, Windows often creates a shortcut, an .lnk file, in the recent items folder. This shortcut contains the path of the original file, its dates, the volume it was on and sometimes the drive's serial number. The shortcut remains even if the original file is deleted or the medium is disconnected.
Jump Lists are the lists of recent files that appear when you right-click a program in the taskbar. They are organised by application and show which files were opened with which program.
ShellBags
ShellBags are registry entries that store folder view preferences, such as window size and icon type. As a side effect, they keep a list of the folders the user visited, including those on external drives or network paths that are no longer available.
Other useful sources
- Recycle Bin: keeps deleted files with the deletion date and original path;
- volume shadow copies: snapshots of the drive that may contain earlier versions of files and of the registry;
- Windows search history and search index;
- resource usage logs, which record application activity over time.
Interpret with care
Windows artifacts change between system versions and sometimes between updates. Behaviour documented for one version may not hold for another. When a conclusion depends on a technical detail, it is good practice to verify it on a test system running the same version. Moreover, many artifacts indicate an action by the system or a program, not necessarily by a person: the possibility of automated processes must always be considered.
In short
- The registry keeps installed programs, recent files, networks and accounts.
- Prefetch proves programs were run, even if later deleted.
- Event logs document logons, services, remote connections and changes.
- LNK files, Jump Lists and ShellBags reveal files and folders opened, even ones no longer present.
- Artifacts vary between versions and should be interpreted by checking real behaviour.