The Windows Forensic Analysis Playbook is a field-ready reference built to help DFIR practitioners understand six critical Windows artifacts, where they are stored, and their role in forensic investigations.
- Jump Lists: Reconstruct application usage and file access patterns tied to user accounts.
- LNK Files: Identify evidence of file and folder access, including activity tied to removable media and network shares.
- RecentDocs & OpenSave MRU: Review recent user interactions and file access order stored in the Windows Registry.
- Prefetch: Understand how Windows records program execution, run counts, and execution timestamps.
- SRUM: Examine application usage and network activity history stored in the SRUM database.
- Windows Event Logs: Analyze authentication, service creation, and system activity recorded in EVTX logs
