Windows Forensic Analysis

Windows Forensic Analysis is a critical process in digital investigations that focuses on examining a Windows-based system to uncover evidence of user activity, security incidents, or malicious behavior. It primarily involves analyzing system data and artifacts to reconstruct events and identify potential threats.

At its core, Windows forensic analysis focuses on two key areas:

• In-depth analysis of the Windows Operating System
• Examination of Windows system artifacts

Windows Artifacts

Windows artifacts are data sources that capture and store information about user and system activities within the Windows operating system.

• Track system and user activity: Record actions such as program execution, file access, browsing behavior, and system changes.
• Provide valuable insights: Help analysts understand how a system has been used over time.
• Vary across Windows versions: Their structure, type, and storage locations differ depending on the operating system version.
• Contain sensitive information: Store critical data that can reveal detailed user behavior.
• Support forensic investigations: Act as key evidence sources for uncovering system activity and identifying potential security issues.

Forensic Artifacts

Forensic artifacts are digital objects that hold evidentiary value in an investigation. These include logs, registry entries, files, caches, and metadata that preserve traces of past actions within a system.

They play a crucial role in digital forensics by enabling investigators to:

• Reconstruct user activity: Understand what actions were performed on the system
• Identify security incidents: Detect unauthorized access or breaches
• Detect malicious behavior: Uncover malware execution or suspicious patterns
• Establish event timelines: Build a sequence of events for analysis and reporting

Windows Forensic Investigation Process

A structured approach ensures accurate and reliable forensic analysis:

1. Evidence Collection: Acquire system data such as disk images and memory dumps
2. Data Preservation: Maintain integrity using hashing and proper handling techniques
3. Artifact Analysis: Examine system artifacts to extract relevant information
4. Timeline Reconstruction: Correlate events to understand the sequence of activities
5. Reporting: Document findings clearly for legal or organizational use

Key Windows Forensic Artifacts

1. Recycle Bin

The Windows Recycle Bin stores deleted files and provides useful forensic evidence.

Key Components:

• $I files: Store metadata such as original file path, deletion time, and file size
• $R files: Contain the actual content of deleted files

Location: C:\$Recycle.Bin\SID*\

Tools: $I Parse

2. Web Browsers

Browsers are rich sources of user activity data.

Artifacts Include:

• Cookies
• Cached data
• Browsing history
• Download records

These artifacts help investigators understand user behavior and online activity.

3. Windows Error Reporting (WER)

Windows Error Reporting logs system and application crashes.

Key Insights:

• Program execution traces
• Crash reports of suspicious or malicious applications

Locations:

• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue
• C:\Users\XXX\AppData\Local\Microsoft\Windows\WER\ReportQueue

4. Remote Desktop Protocol (RDP) Cache

RDP cache files store fragments of remote sessions.

Use Cases:

• Identify lateral movement in networks
• Reconstruct remote session activity

Location: C:\Users\XXX\AppData\Local\Microsoft\Terminal Server Client\Cache

Tools: BMC-Tools

5. LNK Files (Shortcut Files)

LNK files act as shortcuts and store metadata about accessed files.

Information Extracted:

• Original file path
• File timestamps
• File attributes (hidden, system, etc.)
• Device and disk details
• MAC address
• Execution context (local/remote)

Tools: LECmd, Windows LNK Parsing Library

6. Jump Lists

Jump Lists track recently accessed files and applications.

Types:

• AutomaticDestinations: Created automatically
• CustomDestinations: Created when items are pinned

Locations:

• C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
• C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

Tools: JumpList Explorer, JLECmd

7. Prefetch Files

Prefetch files provide insights into application execution.

Information Included:

• Application name and path
• Last execution time
• File creation timestamp

Location: C:\Windows\Prefetch\

Tools: PECmd, WinPrefetchView

Top Open-Source Tools for Windows Forensic Analysis

• Magnet Encrypted Disk Detector: Detects encrypted drives (e.g., BitLocker, PGP).
• Magnet RAM Capture: Captures and analyzes system memory (RAM).
• Wireshark: A powerful network protocol analyzer for monitoring traffic.
• RAM Capture: Extracts volatile memory for forensic investigation.
• Nmap: Used for network scanning and identifying open ports and vulnerabilities.
• NetworkMiner: A passive network sniffer used to analyze network traffic and sessions.
• Autopsy: A GUI-based digital forensics platform for analyzing disks and mobile devices.
• Forensic Investigator (Splunk Toolkit): Provides features like HEX/Base64 conversion and threat analysis.
• HashMyFiles: Generates hash values (MD5, SHA1) to verify file integrity.
• CrowdResponse: Collects system information for incident response.
• ExifTool: Reads and edits metadata from various file types.
• FAW (Forensic Acquisition of Websites): Captures web pages, including HTML, images, and source code.

Practical Example of Windows Forensic Analysis

If a malicious program is executed on a system:

• Prefetch files confirm execution time
• Amcache verifies program presence
• Event logs show related system activity
• LNK files reveal file access paths

By correlating these artifacts, investigators can reconstruct the attack timeline and identify the source.