Forensics

Common Event ID’s for review

• 4624 / 4625: Successful / Failed Logon
• 4672: Special Privileges Assigned (Admin Logon)
• 4688 / 4689: Process Creation / Termination
• 7045: New Service Installed
• 1102: Audit Log Cleared

Artifact Paths

• System Registry Hives: %SystemRoot%\System32\config\ (SAM, SECURITY, SOFTWARE, SYSTEM)
• User Registry Hives: \Users\<username>\NTUSER.DAT and \Users\<username>\AppData\Local\Microsoft\Windows\USRCLASS.DAT
• Event Logs: %SystemRoot%\System32\winevt\Logs\ (Security.evtx, System.evtx, Application.evtx)
• Prefetch Files: %SystemRoot%\Prefetch\
• Shortcut & Shell Items: %SystemRoot%\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\

System Information

OS Version:

• SOFTWARE\Microsoft\Windows NT\CurrentVersion

Current Control set:

• HKLM\SYSTEM\CurrentControlSet
• SYSTEM\Select\Current
• SYSTEM\Select\LastKnownGood

Computer Name:

• SYSTEM\CurrentControlSet\Control\ComputerName
• \ComputerName

Network Interfaces and Past Networks:

• SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces

Autostart Programs:

• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
• SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
• SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
• SOFTWARE\Microsoft\Windows\CurrentVersion\Run

SAM hive and user information:

• SAM\Domains\Account\Users

File/folder Activity and Information

Recent Files:

• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Office Recents:

• NTUSER.DAT\Software\Microsoft\Office\VERSION
• NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_$$$\FileMRU

ShellBags:

Shellbags are settings in explorer like window size, icon size, position etc.

• USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags
• USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
• NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU
• NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags

Open/Save and LastVisited Dialog MRUs:

• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU
• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

Windows Explorer Address and Search Bars:

• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
• NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery

External device and USB forensics

Device identification:

• SYSTEM\CurrentControlSet\Enum\USBSTOR
• SYSTEM\CurrentControlSet\Enum\USB

First/Last Times:

• SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\$$$

Where $$$ in the path above is:

• Oo64 shows first connection
• 0066 shows last connection
• 0067 shows last removal

Execution Evidence

UserAssist:

• NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count

ShimCache:

• SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

AmCache:

• Amcache.hve\Root\File\{Volume GUID}\

BAM/DAM:

• SYSTEM\CurrentControlSet\Services\bam\UserSettings

USB device Volume Name:

• SOFTWARE\Microsoft\Windows Portable Devices\Devices\{SID}\{SID}SYSTEM\