Windows Forensic Analysis Playbook

The Windows Forensic Analysis Playbook, published by SANS Institute in March 2026, is a microlearning reference covering six critical Windows artifacts investigators rely on during digital forensic examinations. The playbook explains what each artifact is, where it is stored, and what it reveals, giving practitioners a practical quick-reference for consistent Windows investigations.

Key findings:

• Jump Lists track up to approximately 2,000 recently or frequently accessed files per application, per user account
• LNK shortcut files persist even after the original file is deleted, preserving evidence of file access that would otherwise be lost
• The Windows Recent folder displays roughly 149 LNK files to the user through File Explorer, though many more can be recovered using forensic tools or the command line
• RecentDocs stores the 150 most recent items a user account accessed, with up to 20 entries per file extension (30 for folders or extensionless files) in its subkeys
• OpenSavePidlMRU tracks the 20 most recently accessed files of any extension, plus another 20 per specific extension type
• Prefetch can retain up to 1,024 .pf files, each recording an application's last eight execution times and the DLLs it loaded
• Prefetch is frequently disabled by default on Windows servers, limiting its availability as execution evidence
• SRUM (System Resource Usage Monitor) only retains roughly 30 to 60 days of application and network usage history before entries age out
• Windows Event Logs are organized into three primary logs (System, Security, Application) plus hundreds of custom logs, with the Security log typically the most valuable to an investigation
• Failed logon attempts and inbound/outbound RDP connection logging are not enabled by default in Windows Event Logs, despite being high-value for detecting lateral movement

Taken together, these six artifacts show that no single data source gives investigators a complete picture of user or attacker activity on a Windows system. Jump Lists, LNK files, and MRU keys reconstruct what a user opened and when, while Prefetch, SRUM, and Event Logs establish whether programs executed, how systems communicated, and what persistence mechanisms were installed. Correlating artifacts across these categories is what turns isolated data points into a defensible timeline, since a bypass or gap in one artifact rarely extends to all six. This playbook functions as a companion quick-reference to SANS FOR500: Windows Forensic Analysis, the course that explores these artifacts in depth and maps to the GIAC Certified Forensic Examiner (GCFE) certification.