Skip to content
Binalyze Knowledge Base

Windows Collections

Windows Evidence List

Section titled “Windows Evidence List”
# Evidence
(click for details)		 Category Parsed Sent to the
Investigation Hub		 Raw Files
Collected
1 $Boot DiskFilesystem No Yes Yes
2 $Log File DiskFilesystem No Yes Yes
3 $Secure:$SDS DiskFilesystem No Yes Yes
4 $TxfLog $Tops:$T DiskFilesystem No Yes Yes
5 ARP Table Network Yes Yes No
6 AVG Logs Applications No No Yes
7 Action1 RMM Logs Applications No No Yes
8 Active Directory Logs Applications No No Yes
9 AI Agent Events AI Yes Yes No
10 AI Agents AI Yes Yes No
11 AI Artifacts AI No Yes Yes
12 AI Commands AI Yes Yes No
13 AI Configs AI Yes Yes No
14 AI Hooks AI Yes Yes No
15 AI MCP AI Yes Yes No
16 AI Models AI Yes Yes No
17 AI Rules AI Yes Yes No
18 AI Secrets AI Yes Yes No
19 AI Sessions AI Yes Yes No
20 AI Skills AI Yes Yes No
21 AmCache System Yes Yes Yes
22 AmmyAdmin Logs Applications No No Yes
23 Antivirus Information System Yes Yes No
24 AnyDesk Logs Applications No No Yes
25 Apache Logs Applications No No Yes
26 AppCompactCache System Yes Yes No
27 AppPaths System Yes Yes No
28 Avast Logs Applications No No Yes
29 Avira Logs Applications No No Yes
30 Bitdefender Logs Applications No No Yes
31 Brave Bookmarks Applications Yes Yes No
32 Brave Browsing History Applications Yes Yes No
33 Brave Cookies Applications Yes Yes No
34 Brave Downloads Applications Yes Yes No
35 Brave Extensions Applications Yes Yes No
36 Brave Favicons Applications Yes Yes No
37 Brave Form History Applications Yes Yes No
38 Brave Local Storage Applications Yes Yes No
39 Brave Login Data Applications Yes Yes No
40 Brave Sessions Applications Yes Yes No
41 Brave Thumbnails Applications Yes Yes No
42 Brave User Profiles Applications Yes Yes No
43 Brave Web Storage Applications Yes Yes No
44 CIDSizeMRU System Yes Yes No
45 CLR System No Yes Yes
46 Carbon Black Logs Applications No No Yes
47 Clipboard History System Yes Yes Yes
48 Chrome Bookmarks Applications Yes Yes No
49 Chrome Browsing History Applications Yes Yes No
50 Chrome Cookies Applications Yes Yes No
51 Chrome Downloads Applications Yes Yes No
52 Chrome Extensions Applications Yes Yes No
53 Chrome Favicons Applications Yes Yes No
54 Chrome Form History Applications Yes Yes No
55 Chrome Local Storage Applications Yes Yes No
56 Chrome Login Data Applications Yes Yes No
57 Chrome Sessions Applications Yes Yes No
58 Chrome Thumbnails Applications Yes Yes No
59 Chrome User Profiles Applications Yes Yes No
60 Chrome Web Storage Applications Yes Yes No
61 Cisco AMP Logs Applications No No Yes
62 Collect LNK Files System Yes Yes Yes
63 Collect SRUM Database Files System No No Yes
64 ComboFix Applications No No Yes
65 Cortana History Applications No No Yes
66 Crash Dump Information System Yes Yes No
67 Cybereason Logs Applications No No Yes
68 Cylance Logs Applications No No Yes
69 DHCP Server Logs Applications No No Yes
70 DNS Cache Network Yes Yes No
71 DNS Server Logs Applications No No Yes
72 DNS Servers Network Yes Yes No
73 Deep Instinct Logs Applications No No Yes
74 Default Browser Applications Yes Yes No
75 Dependency Manifests Applications Yes Yes No
76 Discord Desktop Cache Applications No No Yes
77 Docker Changes Applications Yes Yes No
78 Docker Container Logs Applications Yes Yes No
79 Docker Containers Applications Yes Yes No
80 Docker Image History Applications Yes Yes No
81 Docker Images Applications Yes Yes No
82 Docker Info Applications Yes Yes No
83 Docker Networks Applications Yes Yes No
84 Docker Processes Applications Yes Yes No
85 Docker Volumes Applications Yes Yes No
86 Downloaded Files Information System Yes Yes No
87 Driver Objects System Yes Yes No
88 Drivers List System Yes Yes No
89 Dropbox Cache Applications No No Yes
90 Dropbox Databases Applications No No Yes
91 Dropbox Logs Applications No No Yes
92 Dump Brave Indexed DB Applications Yes Yes No
93 Dump Chrome Indexed DB Applications Yes Yes No
94 Dump Edge Indexed DB Applications Yes Yes No
95 Dump Opera Indexed DB Applications Yes Yes No
96 Dump QQ Indexed DB Applications Yes Yes No
97 Dump Vivaldi Indexed DB Applications Yes Yes No
98 ETL System No Yes Yes
99 Edge Bookmarks Applications Yes Yes No
100 Edge Cookies Applications Yes Yes No
101 Edge Downloads Applications Yes Yes No
102 Edge Extensions Applications Yes Yes No
103 Edge Favicons Applications Yes Yes No
104 Edge Form History Applications Yes Yes No
105 Edge Local Storage Applications Yes Yes No
106 Edge Login Data Applications Yes Yes No
107 Edge Sessions Applications Yes Yes No
108 Edge Thumbnails Applications Yes Yes No
109 Edge User Profiles Applications Yes Yes No
110 Edge Web Storage Applications Yes Yes No
111 Elastic Logs Applications No No Yes
112 Environment Variables System Yes Yes No
113 Eset Logs Applications No No Yes
114 Event Log EVT Files EventLogs Yes Yes No
115 Event Log EVT Records EventLogs Yes Yes Yes
116 Event Log EVTX Files EventLogs Yes Yes No
117 EventTranscript DB System Yes Yes Yes
118 Evernote Databases Applications No No Yes
119 Evernote Drag and Drop Files Applications No No Yes
120 Evernote Logs Applications No No Yes
121 Everything History Applications No No Yes
122 F-Secure Logs Applications No No Yes
123 Facebook Cache Applications No No Yes
124 Facebook Databases Applications No No Yes
125 FileExts System Yes Yes No
126 FileZilla Sessions Applications No No Yes
127 FireEye Logs Applications No No Yes
128 Firefox Browsing History Applications Yes Yes No
129 Firefox Cookies Applications Yes Yes No
130 Firefox Downloads Applications Yes Yes No
131 Firefox Extensions Applications Yes Yes No
132 Firewall Rules Network Yes Yes No
133 FirstFolder System Yes Yes No
134 Github Desktop Cache Applications No No Yes
135 Github Desktop Databases Applications No No Yes
136 Github Desktop Logs Applications No No Yes
137 GoTo Logs Applications No No Yes
138 Google Drive Databases Applications No No Yes
139 Hibernation File Memory No Yes Yes
140 HitmanPro Logs Applications No No Yes
141 Hosts Network Yes Yes Yes
142 IE 10,11,Edge Browsing History Applications Yes Yes Yes
143 IE 7,8,9 Browsing History Applications Yes Yes Yes
144 IIS Logs Applications No No Yes
145 INF Setup System No Yes Yes
146 IPv4 Routes Network Yes Yes No
147 Iconcache System No Yes Yes
148 IDE Extensions Applications Yes Yes No
149 Installed Applications System Yes Yes No
150 JumpList Automatic Entries System Yes Yes No
151 JumpList Automatic Files System Yes Yes Yes
152 JumpList Custom Entries System Yes Yes No
153 JumpList Custom Files System Yes Yes Yes
154 Kaseya Logs Applications No No Yes
155 LastVisitedPidlMRU System Yes Yes No
156 Level Logs Applications No No Yes
157 LinkedIn Cache Applications No No Yes
158 LogMeIn Logs Applications No No Yes
159 MBR DiskFilesystem No Yes Yes
160 MFT DiskFilesystem No Yes Yes
161 MFT Mirror DiskFilesystem No Yes Yes
162 MFT as CSV DiskFilesystem Yes No No
163 MSSQL Logs Applications No No Yes
164 MalwareBytes Logs Applications No No Yes
165 Map Network Drive MRU System Yes Yes No
166 McAfee Logs Applications No No Yes
167 Microsoft Calendar Applications No No Yes
168 Microsoft Exchange Logs Applications No No Yes
169 Microsoft Mail Applications No No Yes
170 Microsoft Maps Applications No No Yes
171 Microsoft Outlook Applications No No Yes
172 Microsoft People Applications No No Yes
173 Microsoft Photos Applications No No Yes
174 Microsoft Sticky Notes Applications No No Yes
175 Microsoft Store Applications List Applications No No Yes
176 Microsoft Voice Record History Applications No No Yes
177 MongoDB Logs Applications No No Yes
178 Mozilla Thunderbird Applications No No Yes
179 NTDS.dit System No Yes Yes
180 Network Adapters Network Yes Yes No
181 Network Shares Network Yes Yes No
182 Notepad++ Sessions Applications No No Yes
183 Object Directory System Yes Yes No
184 OfficeMRU System Yes Yes No
185 Old Registry Hives System No Yes Yes
186 OneDrive Logs Applications No No Yes
187 OpenSavePidlMRU System Yes Yes No
188 OpenVPN Config Applications No No Yes
189 Opera Bookmarks Applications Yes Yes No
190 Opera Browsing History Applications Yes Yes No
191 Opera Cookies Applications Yes Yes No
192 Opera Downloads Applications Yes Yes No
193 Opera Extensions Applications Yes Yes No
194 Opera Favicons Applications Yes Yes No
195 Opera Form History Applications Yes Yes No
196 Opera Local Storage Applications Yes Yes No
197 Opera Login Data Applications Yes Yes No
198 Opera Sessions Applications Yes Yes No
199 Opera Thumbnails Applications Yes Yes No
200 Opera User Profiles Applications Yes Yes No
201 Opera Web Storage Applications Yes Yes No
202 PDB Information System Yes Yes No
203 Page File Memory No Yes Yes
204 Palo Alto Logs Applications No No Yes
205 Parse LNK Files System Yes Yes No
206 Parse SRUM Application Timeline System No Yes No
207 Parse SRUM Application Usage System No Yes No
208 Parse SRUM Energy Usage System No Yes No
209 Parse SRUM Network Connectivity System No Yes No
210 Parse SRUM Network Usage System No Yes No
211 Powershell ConsoleHost History System Yes Yes No
212 Powershell Logs System No Yes Yes
213 Prefetch Files System Yes Yes Yes
214 Proxy List Network Yes Yes No
215 QQ Bookmarks Applications Yes Yes No
216 QQ Browsing History Applications Yes Yes No
217 QQ Cookies Applications Yes Yes No
218 QQ Downloads Applications Yes Yes No
219 QQ Extensions Applications Yes Yes No
220 QQ Favicons Applications Yes Yes No
221 QQ Form History Applications Yes Yes No
222 QQ Local Storage Applications Yes Yes No
223 QQ Login Data Applications Yes Yes No
224 QQ Sessions Applications Yes Yes No
225 QQ Thumbnails Applications Yes Yes No
226 QQ User Profiles Applications Yes Yes No
227 QQ Web Storage Applications Yes Yes No
228 Quick Assist System Yes Yes No
229 RAM Image Memory No Yes Yes
230 RDP Cache System No Yes Yes
231 RealVNC Logs Applications No No Yes
232 Recent File Cache System No Yes Yes
233 RecentDocs System Yes Yes No
234 Recycle Bin Information System Yes Yes No
235 Registry Hives System No Yes Yes
236 Registry Items System Yes Yes Yes
237 RemComSvc Logs Applications No No Yes
238 Remote Utilities Logs Applications No No Yes
239 RogueKiller Reports Applications No No Yes
240 RunMRU System Yes Yes No
241 Running Processes and Modules System Yes Yes No
242 SAM Users and Groups System Yes Yes No
243 SDB System No Yes Yes
244 SRUM System Yes Yes Yes
245 SUPERAntiSpyware Logs Applications No No Yes
246 Scheduled Tasks System Yes Yes Yes
247 ScreenConnect (ConnectWise Control) Application Data Applications No No Yes
248 Search History Applications No No Yes
249 SentinelOne Logs Applications No No Yes
250 Service List System Yes Yes Yes
251 Shadow Copy as CSV DiskFilesystem Yes Yes No
252 ShellBags System Yes Yes No
253 ShellFolders System Yes Yes No
254 Skype Databases Applications No No Yes
255 Skype Media Applications No No Yes
256 Sophos Logs Applications No No Yes
257 Sourcefire FireAMP Logs Applications No No Yes
258 Splashtop Logs Applications No No Yes
259 Spotify Cache Applications No No Yes
260 Spotify Recently Played List Applications No No Yes
261 Startup Items System Yes Yes Yes
262 Sublime Text Sessions Applications No No Yes
263 Superfetch System No Yes Yes
264 Supremo Remote Desktop Logs Applications No No Yes
265 Swap File Memory No Yes Yes
266 Symantec Logs Applications No No Yes
267 System Restore Points Information System Yes Yes No
268 TCP Table Network Yes Yes No
269 Tanium Logs Applications No No Yes
270 Teamviewer Logs Applications No No Yes
271 Telegram Desktop Data Applications No No Yes
272 Telegram Desktop Download Applications No No Yes
273 Thumbcache System No Yes Yes
274 TightVNC Logs Applications No No Yes
275 Tortoise Git Logs Applications No No Yes
276 TotalAv Logs Applications No No Yes
277 Trend Micro Logs Applications No No Yes
278 Twitter Cache Applications No No Yes
279 Twitter Databases Applications No No Yes
280 TypedPaths System Yes Yes No
281 TypedURLs System Yes Yes No
282 UDP Table Network Yes Yes No
283 USB Storage History DiskFilesystem Yes Yes No
284 USN Journal DiskFilesystem No Yes Yes
285 USN Journal $Max DiskFilesystem No Yes Yes
286 USN Journal as CSV DiskFilesystem Yes Yes No
287 UltraVNC Logs Applications No No Yes
288 Ultraviewer Logs Applications No No Yes
289 User Access Logs (UAL) System Yes Yes Yes
290 User Folders System Yes Yes No
291 UserAssist System Yes Yes No
292 Users System Yes Yes No
293 VIPRE Logs Applications No No Yes
294 VMware Config Applications No No Yes
295 VMware Drag and Drop Files Applications No No Yes
296 VMware Logs Applications No No Yes
297 Visual Studio Team Explorer Config Applications No No Yes
298 Vivaldi Bookmarks Applications Yes Yes No
299 Vivaldi Browsing History Applications Yes Yes No
300 Vivaldi Cookies Applications Yes Yes No
301 Vivaldi Downloads Applications Yes Yes No
302 Vivaldi Extensions Applications Yes Yes No
303 Vivaldi Favicons Applications Yes Yes No
304 Vivaldi Form History Applications Yes Yes No
305 Vivaldi Local Storage Applications Yes Yes No
306 Vivaldi Login Data Applications Yes Yes No
307 Vivaldi Sessions Applications Yes Yes No
308 Vivaldi Thumbnails Applications Yes Yes No
309 Vivaldi User Profiles Applications Yes Yes No
310 Vivaldi Web Storage Applications Yes Yes No
311 Volumes Information DiskFilesystem Yes Yes No
312 WBEM System No Yes Yes
313 WMI Active Script System Yes Yes No
314 WMI Command Line System Yes Yes No
315 WSL Applications No No Yes
316 Webroot Logs Applications No No Yes
317 WhatsApp Desktop Cache Applications No No Yes
318 WhatsApp Desktop Cookie Applications No No Yes
319 WinRAR History Applications Yes Yes No
320 Windows Defender Logs Applications No No Yes
321 Windows Error Reporting Files System No No Yes
322 Windows Index Search System No Yes Yes
323 Windows Live Mail User Settings Applications No No Yes
324 Windows Notification History Applications No No Yes
325 Windows Timeline System Yes Yes Yes
326 Wireless Connection History Network Yes Yes No
327 WordWheelQuery System Yes Yes No
328 Xeox Logs Applications No No Yes
329 ZohoAssist Logs Applications No No Yes
330 Zoom Databases Applications No No Yes
331 Zoom Media Applications No No Yes
332 iTunes Backups Applications No No Yes