Windows Collections

AIR supports the following Windows Evidence and Artifacts

Windows Evidence List

#	Category	Evidence (click for details)	Parsed	Investigation Hub	Source Files Collected
1	System	Crash Dump Information	Yes	Yes	No
2	System	Recycle Bin Information	Yes	Yes	No
3	System	System Restore Points Information	Yes	Yes	No
4	System	Drivers List	Yes	Yes	No
5	System	Running Processes and Modules	Yes	Yes	No
6	System	Antivirus Information	Yes	Yes	No
7	System	DNS Servers	Yes	Yes	No
8	System	Proxy List	Yes	Yes	No
9	System	Installed Applications	Yes	Yes	No
10	System	Firewall Rules	Yes	Yes	No
11	System	USB Storage History	Yes	Yes	No
12	System	Downloaded Files Information	Yes	Yes	No
13	System	Shadow Copy as CSV	Yes	Yes	No
14	System	EventTranscript DB	Yes	Yes	No
15	System	Users	Yes	Yes	No
16	System	User Access Logs (UAL)	Yes	Yes	No
17	System	SAM Users and Groups	Yes	Yes	No
18	System	Wireless Connection History	Yes	Yes	No
19	System	PowerShell History	Yes	Yes	No
20	System	NTDS.dit	No	Yes	No
21	System	Environment Variables	Yes	Yes	No
22	System	User Folders	Yes	Yes	No
23	System	PDB Information	Yes	Yes	No
24	System	Object Directory	Yes	Yes	No
25	System	Driver Objects	Yes	Yes	No
26	Persistence	WMI Active Script	Yes	Yes	No
27	Persistence	WMI Command Line	Yes	Yes	No
28	Persistence	Registry Items	Yes	Yes	No
29	Persistence	Scheduled Tasks	Yes	Yes	No
30	Persistence	Service List	Yes	Yes	No
31	Persistence	Startup Items	Yes	Yes	No
32	Disk	Volumes Information	Yes	Yes	No
33	Disk	MBR	No	Yes	No
34	Memory	RAM Image	No	No	Yes
35	Memory	Page File	No	No	Yes
36	Memory	Swap File	No	No	Yes
37	Memory	Hibernation File	No	No	Yes
38	Browser	Default Browser	Yes	Yes	No
39	Browser	Chrome Cookies	Yes	Yes	No
40	Browser	Edge Cookies	Yes	Yes	No
41	Browser	Opera Cookies	Yes	Yes	No
42	Browser	Vivaldi Cookies	Yes	Yes	No
43	Browser	Brave Cookies	Yes	Yes	No
44	Browser	QQ Cookies	Yes	Yes	No
45	Browser	Chrome Bookmarks	Yes	Yes	No
46	Browser	Edge Bookmarks	Yes	Yes	No
47	Browser	Opera Bookmarks	Yes	Yes	No
48	Browser	Vivaldi Bookmarks	Yes	Yes	No
49	Browser	Brave Bookmarks	Yes	Yes	No
50	Browser	QQ Bookmarks	Yes	Yes	No
51	Browser	Chrome User Profiles	Yes	Yes	No
52	Browser	Edge User Profiles	Yes	Yes	No
53	Browser	Opera User Profiles	Yes	Yes	No
54	Browser	Vivaldi User Profiles	Yes	Yes	No
55	Browser	Brave User Profiles	Yes	Yes	No
56	Browser	QQ User Profiles	Yes	Yes	No
57	Browser	Chrome Extensions	Yes	Yes	No
58	Browser	Edge Extensions	Yes	Yes	No
59	Browser	Opera Extensions	Yes	Yes	No
60	Browser	Brave Extensions	Yes	Yes	No
61	Browser	Vivaldi Extensions	Yes	Yes	No
62	Browser	QQ Extensions	Yes	Yes	No
63	Browser	Firefox Extensions	Yes	Yes	No
64	Browser	Chrome Local Storage	Yes	Yes	No
65	Browser	Edge Local Storage	Yes	Yes	No
66	Browser	Opera Local Storage	Yes	Yes	No
67	Browser	Vivaldi Local Storage	Yes	Yes	No
68	Browser	Brave Local Storage	Yes	Yes	No
69	Browser	QQ Local Storage	Yes	Yes	No
70	Browser	Dump Chrome Indexed DB	Yes	Yes	Yes
71	Browser	Dump Edge Indexed DB	Yes	Yes	Yes
72	Browser	Dump Opera Indexed DB	Yes	Yes	Yes
73	Browser	Dump Vivaldi Indexed DB	Yes	Yes	Yes
74	Browser	Dump Brave Indexed DB	Yes	Yes	Yes
75	Browser	Dump QQ Indexed DB	Yes	Yes	Yes
76	Browser	Chrome Web Storage	Yes	Yes	No
77	Browser	Edge Web Storage	Yes	Yes	No
78	Browser	Opera Web Storage	Yes	Yes	No
79	Browser	Vivaldi Web Storage	Yes	Yes	No
80	Browser	Brave Web Storage	Yes	Yes	No
81	Browser	QQ Web Storage	Yes	Yes	No
82	Browser	Chrome Form History	Yes	Yes	No
83	Browser	Edge Form History	Yes	Yes	No
84	Browser	Opera Form History	Yes	Yes	No
85	Browser	Vivaldi Form History	Yes	Yes	No
86	Browser	Brave Form History	Yes	Yes	No
87	Browser	QQ Form History	Yes	Yes	No
88	Browser	Chrome Thumbnails	Yes	Yes	No
89	Browser	Edge Thumbnails	Yes	Yes	No
90	Browser	Opera Thumbnails	Yes	Yes	No
91	Browser	Vivaldi Thumbnails	Yes	Yes	No
92	Browser	Brave Thumbnails	Yes	Yes	No
93	Browser	QQ Thumbnails	Yes	Yes	No
94	Browser	Chrome Favicons	Yes	Yes	No
95	Browser	Edge Favicons	Yes	Yes	No
96	Browser	Opera Favicons	Yes	Yes	No
97	Browser	Vivaldi Favicons	Yes	Yes	No
98	Browser	Brave Favicons	Yes	Yes	No
99	Browser	QQ Favicons	Yes	Yes	No
100	Browser	Chrome Login Data	Yes	Yes	No
101	Browser	Edge Login Data	Yes	Yes	No
102	Browser	Opera Login Data	Yes	Yes	No
103	Browser	Vivaldi Login Data	Yes	Yes	No
104	Browser	Brave Login Data	Yes	Yes	No
105	Browser	QQ Login Data	Yes	Yes	No
106	Browser	Chrome Sessions	Yes	Yes	No
107	Browser	Edge Sessions	Yes	Yes	No
108	Browser	Opera Sessions	Yes	Yes	No
109	Browser	Brave Sessions	Yes	Yes	No
110	Browser	Vivaldi Sessions	Yes	Yes	No
111	Browser	QQ Sessions	Yes	Yes	No
112	Browser	Chrome Browsing History	Yes	Yes	No
113	Browser	Firefox Browsing History	Yes	Yes	No
114	Browser	IE 7,8,9 Browsing History	Yes	Yes	No
115	Browser	IE 10,11,Edge Browsing History	Yes	Yes	No
116	Browser	Opera Browsing History	Yes	Yes	No
117	Browser	Brave Browsing History	Yes	Yes	No
118	Browser	Vivaldi Browsing History	Yes	Yes	No
119	Browser	QQ Browsing History	Yes	Yes	No
120	Browser	Chrome Downloads	Yes	Yes	No
121	Browser	Edge Downloads	Yes	Yes	No
122	Browser	Firefox Downloads	Yes	Yes	No
123	Browser	Opera Downloads	Yes	Yes	No
124	Browser	Brave Downloads	Yes	Yes	No
125	Browser	Vivaldi Downloads	Yes	Yes	No
126	Browser	QQ Downloads	Yes	Yes	No
127	Browser	Firefox Cookies	Yes	Yes	No
128	NTFS	MFT as CSV	Yes	Yes	No
129	NTFS	MFT	No	Yes	No
130	NTFS	MFT Mirror	No	Yes	No
131	NTFS	USN Journal as CSV	Yes	Yes	No
132	NTFS	$Log File	No	Yes	No
133	NTFS	USN Journal	No	Yes	No
134	NTFS	$Boot	No	Yes	No
135	NTFS	USN Journal $Max	No	Yes	No
136	NTFS	$Secure:$SDS	No	Yes	No
137	NTFS	$TxfLog $Tops:$T	No	Yes	No
138	Registry	Registry Hives	No	Yes	No
139	Registry	Old Registry Hives	No	Yes	No
140	Registry	ShellBags	Yes	Yes	No
141	Registry	AppCompactCache	Yes	Yes	No
142	Registry	UserAssist	Yes	Yes	No
143	Registry	TypedPaths	Yes	Yes	No
144	Registry	FirstFolder	Yes	Yes	No
145	Registry	RecentDocs	Yes	Yes	No
146	Registry	WordWheelQuery	Yes	Yes	No
147	Registry	FileExts	Yes	Yes	No
148	Registry	ShellFolders	Yes	Yes	No
149	Registry	RunMRU	Yes	Yes	No
150	Registry	Map Network Drive MRU	Yes	Yes	No
151	Registry	TypedURLs	Yes	Yes	No
152	Registry	OfficeMRU	Yes	Yes	No
153	Registry	AppPaths	Yes	Yes	No
154	Registry	CIDSizeMRU	Yes	Yes	No
155	Registry	LastVisitedPidlMRU	Yes	Yes	No
156	Registry	OpenSavePidlMRU	Yes	Yes	No
157	Registry	Winrar History	Yes	Yes	No
158	Network	DNS Cache	Yes	Yes	No
159	Network	TCP Table	Yes	Yes	No
160	Network	UDP Table	Yes	Yes	No
161	Network	ARP Table	Yes	Yes	No
162	Network	IPv4 Routes	Yes	Yes	No
163	Network	Network Adapters	Yes	Yes	No
164	Network	Network Shares	Yes	Yes	No
165	Network	Hosts	Yes	Yes	No
166	Event Logs	Event Log EVT Files	Yes	Yes	No
167	Event Logs	Event Log EVTX Files	Yes	Yes	Yes
168	Event Logs	Event Log EVT Records	Yes	Yes	Yes
169	Process Execution	Prefetch Files	Yes	Yes	No
170	Process Execution	SRUM	Yes	Yes	No
171	Process Execution	Windows Timeline	Yes	Yes	Yes
172	Process Execution	AmCache	Yes	Yes	No
173	Process Execution	Recent File Cache	No	Yes	No
174	Process Execution	Parse LNK Files	awaits	awaits	awaits
175	Process Execution	Collect LNK Files	Yes	Yes	No
176	Process Execution	JumpList Automatic Files	Yes	Yes	Yes
177	Process Execution	JumpList Automatic Entries	Yes	Yes	No
178	Process Execution	JumpList Custom Files	Yes	Yes	Yes
179	Process Execution	JumpList Custom Entries	Yes	Yes	No
180	Other Evidence	ETL	No	Yes	No
181	Other Evidence	CLR	No	Yes	No
182	Other Evidence	Windows Index Search	No	Yes	No
183	Other Evidence	Superfetch	No	Yes	No
184	Other Evidence	WBEM	No	Yes	No
185	Other Evidence	INF Setup	No	Yes	No
186	Other Evidence	SDB	No	Yes	No
187	Other Evidence	Powershell Logs	No	Yes	No
188	Other Evidence	Powershell ConsoleHost History	awaits	awaits	awaits
189	Other Evidence	Thumbcache	No	Yes	No
190	Other Evidence	Iconcache	No	Yes	No
191	Other Evidence	RDP Cache	No	Yes	No

Windows Artifact List:

#	Category	Artifact (click for details)	Parsed	Investigation Hub	Source Files Collected
1	Server	Apache Logs	No	No	Yes
2	Server	MongoDB Logs	No	No	Yes
3	Server	IIS Logs	No	No	Yes
4	Server	MSSQL Logs	No	No	Yes
5	Server	Microsoft Exchange Logs	No	No	Yes
6	Server	DHCP Server Logs	No	No	Yes
7	Server	DNS Server Logs	No	No	Yes
8	Server	Active Directory Logs	No	No	Yes
9	Microsoft Applications	Microsoft Photos	No	No	Yes
10	Microsoft Applications	Cortana History	No	No	Yes
11	Microsoft Applications	Microsoft Store Applications List	No	No	Yes
12	Microsoft Applications	Microsoft Sticky Notes	No	No	Yes
13	Microsoft Applications	Microsoft Maps	No	No	Yes
14	Microsoft Applications	Microsoft Voice Record History	No	No	Yes
15	Microsoft Applications	Windows Notification History	No	No	Yes
16	Microsoft Applications	Search History	No	No	Yes
17	Microsoft Applications	Microsoft People	No	No	Yes
18	Microsoft Applications	Microsoft Calendar	No	No	Yes
19	Communication	Discord Desktop Cache	No	No	Yes
20	Communication	Microsoft Mail	No	No	Yes
21	Communication	Microsoft Outlook	No	No	Yes
22	Communication	Mozilla Thunderbird	No	No	Yes
23	Communication	Skype Databases	No	No	Yes
24	Communication	Skype Media	No	No	Yes
25	Communication	Telegram Desktop Data	No	No	Yes
26	Communication	Telegram Desktop Download	No	No	Yes
27	Communication	WhatsApp Desktop Cache	No	No	Yes
28	Communication	WhatsApp Desktop Cookie	No	No	Yes
29	Communication	Windows Live Mail User Settings	No	No	Yes
30	Communication	Zoom Databases	No	No	Yes
31	Communication	Zoom Media	No	No	Yes
32	Remote Desktop Management Tools	Action1 RMM Logs	No	No	Yes
33	Remote Desktop Management Tools	AmmyAdmin Logs	No	No	Yes
34	Remote Desktop Management Tools	AnyDesk Logs	No	No	Yes
35	Remote Desktop Management Tools	GoTo Logs	No	No	Yes
36	Remote Desktop Management Tools	Kaseya Logs	No	No	Yes
37	Remote Desktop Management Tools	Level Logs	No	No	Yes
38	Remote Desktop Management Tools	LogMeIn Logs	No	No	Yes
39	Remote Desktop Management Tools	RealVNC Logs	No	No	Yes
40	Remote Desktop Management Tools	RemComSvc Logs	No	No	Yes
41	Remote Desktop Management Tools	Remote Utilities Logs	No	No	Yes
42	Remote Desktop Management Tools	ScreenConnect (ConnectWise Control) Application Data	No	No	Yes
43	Remote Desktop Management Tools	Splashtop Logs	No	No	Yes
44	Remote Desktop Management Tools	Supremo Remote Desktop Logs	No	No	Yes
45	Remote Desktop Management Tools	Teamviewer Logs	No	No	Yes
46	Remote Desktop Management Tools	TightVNC Logs	No	No	Yes
47	Remote Desktop Management Tools	Ultraviewer Logs	No	No	Yes
48	Remote Desktop Management Tools	UltraVNC Logs	No	No	Yes
49	Remote Desktop Management Tools	Xeox Logs	No	No	Yes
50	Remote Desktop Management Tools	ZohoAssist Logs	No	No	Yes
51	Social Artifacts	Twitter Databases	No	No	Yes
52	Social Artifacts	Twitter Cache	No	No	Yes
53	Social Artifacts	Facebook Databases	No	No	Yes
54	Social Artifacts	Facebook Cache	No	No	Yes
55	Social Artifacts	LinkedIn Cache	No	No	Yes
56	Social Artifacts	Spotify Recently Played List	No	No	Yes
57	Social Artifacts	Spotify Cache	No	No	Yes
58	Productivity Artifacts	Sublime Text Sessions	No	No	Yes
59	Productivity Artifacts	Notepad++ Sessions	No	No	Yes
60	Productivity Artifacts	OpenVPN Config	No	No	Yes
61	Productivity Artifacts	Everything History	No	No	Yes
62	Productivity Artifacts	Evernote Databases	No	No	Yes
63	Productivity Artifacts	Evernote Drag and Drop Files	No	No	Yes
64	Productivity Artifacts	Evernote Logs	No	No	Yes
65	Utilities Artifacts	iTunes Backups	No	No	Yes
66	Utilities Artifacts	VMware Config	No	No	Yes
67	Utilities Artifacts	VMware Drag and Drop Files	No	No	Yes
68	Utilities Artifacts	VMware Logs	No	No	Yes
69	Developer Tools	FileZilla Sessions	No	No	Yes
70	Developer Tools	Visual Studio Team Explorer Config	No	No	Yes
71	Developer Tools	Github Desktop Databases	No	No	Yes
72	Developer Tools	Github Desktop Cache	No	No	Yes
73	Developer Tools	Github Desktop Logs	No	No	Yes
74	Developer Tools	WSL	No	No	Yes
75	Developer Tools	Tortoise Git Logs	No	No	Yes
76	Cloud Artifacts	Google Drive Databases	No	No	Yes
77	Cloud Artifacts	Dropbox Databases	No	No	Yes
78	Cloud Artifacts	Dropbox Logs	No	No	Yes
79	Cloud Artifacts	Dropbox Cache	No	No	Yes
80	Cloud Artifacts	OneDrive Logs	No	No	Yes
81	Docker	Docker Changes	Yes	Yes	No
82	Docker	Docker Containers	Yes	Yes	No
83	Docker	Docker Image History	Yes	Yes	No
84	Docker	Docker Images	Yes	Yes	No
85	Docker	Docker Info	Yes	Yes	No
86	Docker	Docker Networks	Yes	Yes	No
87	Docker	Docker Processes	Yes	Yes	No
88	Docker	Docker Volumes	Yes	Yes	No
89	Docker	Docker Container Logs	Yes	Yes	No
90	Antivirus Logs	Avast Logs	No	No	Yes
91	Antivirus Logs	AVG Logs	No	No	Yes
92	Antivirus Logs	Avira Logs	No	No	Yes
93	Antivirus Logs	Bitdefender Logs	No	No	Yes
94	Antivirus Logs	Carbon Black Logs	No	No	Yes
95	Antivirus Logs	Cisco AMP Logs	No	No	Yes
96	Antivirus Logs	ComboFix	No	No	Yes
97	Antivirus Logs	Cybereason Logs	No	No	Yes
98	Antivirus Logs	Cylance Logs	No	No	Yes
99	Antivirus Logs	Deep Instinct Logs	No	No	Yes
100	Antivirus Logs	Elastic Logs	No	No	Yes
101	Antivirus Logs	Eset Logs	No	No	Yes
102	Antivirus Logs	F-Secure Logs	No	No	Yes
103	Antivirus Logs	FireEye Logs	No	No	Yes
104	Antivirus Logs	HitmanPro Logs	No	No	Yes
105	Antivirus Logs	MalwareBytes Logs	No	No	Yes
106	Antivirus Logs	McAfee Logs	No	No	Yes
107	Antivirus Logs	Palo Alto Logs	No	No	Yes
108	Antivirus Logs	RogueKiller Reports	No	No	Yes
109	Antivirus Logs	SentinelOne Logs	No	No	Yes
110	Antivirus Logs	Sophos Logs	No	No	Yes
111	Antivirus Logs	Sourcefire FireAMP Logs	No	No	Yes
112	Antivirus Logs	SUPERAntiSpyware Logs	No	No	Yes
113	Antivirus Logs	Symantec Logs	No	No	Yes
114	Antivirus Logs	Tanium Logs	No	No	Yes
115	Antivirus Logs	TotalAv Logs	No	No	Yes
116	Antivirus Logs	Trend Micro Logs	No	No	Yes
117	Antivirus Logs	VIPRE Logs	No	No	Yes
118	Antivirus Logs	Webroot Logs	No	No	Yes
119	Antivirus Logs	Windows Defender Logs	No	No	Yes