Windows Forensic Analysis Playbook

The Windows Forensic Analysis Playbook is a field-ready reference built to help DFIR practitioners understand six critical Windows artifacts, where they are stored, and their role in forensic investigations.

1. Jump Lists: Reconstruct application usage and file access patterns tied to user accounts.
2. LNK Files: Identify evidence of file and folder access, including activity tied to removable media and network shares.
3. RecentDocs & OpenSave MRU: Review recent user interactions and file access order stored in the Windows Registry.
4. Prefetch: Understand how Windows records program execution, run counts, and execution timestamps.
5. SRUM: Examine application usage and network activity history stored in the SRUM database.
6. Windows Event Logs: Analyze authentication, service creation, and system activity recorded in EVTX logs

Continue Your Learning Path with Industry-Recognized Training and Certifications

FOR500: Windows Forensic Analysis

Take these artifacts further by learning how to recover, analyze, and validate digital evidence, correlate activity across systems to build accurate timelines, and uncover what truly happened during an investigation. In FOR500, you will apply proven forensic techniques to track user and system activity, identify key evidence, and answer critical questions in real-world cases.

GIAC Certification: GIAC Certified Forensic Examiner Certification(GCFE)