Windows Collections

Windows Evidence and Artifacts List

Windows Evidence List

CategoryNameCollection Type

System

Crash Dump Information

**File path shown in Investigation Hub

System

Recycle Bin Information

Parsed & presented in Investigation Hub

System

System Restore Points Information

Parsed & presented in Investigation Hub

System

Drivers List

Parsed & presented in Investigation Hub

System

Process and Modules

Parsed & presented in Investigation Hub

System

Antivirus Information

Parsed & presented in Investigation Hub

System

DNS Servers

Parsed & presented in Investigation Hub

System

Proxy List

Parsed & presented in Investigation Hub

System

Installed Applications

Parsed & presented in Investigation Hub

System

Firewall Rules

Parsed & presented in Investigation Hub

System

USB Storage History

Parsed & presented in Investigation Hub

System

Downloaded Files Information

Parsed & presented in Investigation Hub

System

Shadow Copy as CSV

Parsed & saved as CSV

System

EventTranscript DB

Parsed & presented in Investigation Hub

System

Users

Parsed & presented in Investigation Hub

System

User Access Logs (UAL)

Parsed & presented in Investigation Hub

System

SAM Users and Groups

Parsed & presented in Investigation Hub

System

Wireless Connection History

Parsed & presented in Investigation Hub

System

Windows Error Reporting Files

File collected

System

NTDS.dit

File collected

System

Environment Variables

Parsed & presented in Investigation Hub

Persistence

WMI Active Script Event Consumers

File collected

Persistence

WMI Command Line Event Consumers

File collected

Persistence

Registry Items

Parsed & presented in Investigation Hub

Persistence

Scheduled Tasks

Parsed & presented in Investigation Hub

Persistence

Service List

Parsed & presented in Investigation Hub

Persistence

Startup Items

Parsed & presented in Investigation Hub

Disk

Volumes Information

Parsed & presented in Investigation Hub

Disk

MBR

Parsed & presented in Investigation Hub

Memory

RAM Image

File collected

Memory

Page File

File collected

Memory

Swap File

File collected

Memory

Hibernation File

File collected

Browser

Default Browser

Parsed & presented in Investigation Hub

Browser

Chrome Cookies

Parsed & presented in Investigation Hub

Browser

Edge Cookies

Parsed & presented in Investigation Hub

Browser

Opera Cookies

Parsed & presented in Investigation Hub

Browser

Vivaldi Cookies

Parsed & presented in Investigation Hub

Browser

Brave Cookies

Parsed & presented in Investigation Hub

Browser

QQ Cookies

Parsed & presented in Investigation Hub

Browser

Chrome Bookmarks

Parsed & presented in Investigation Hub

Browser

Chrome User Profiles

Parsed & presented in Investigation Hub

Browser

Chrome Extensions

Parsed & presented in Investigation Hub

Browser

Chrome Local Storage

Parsed & presented in Investigation Hub

Browser

Chrome IndexedDB

Parsed & presented in Investigation Hub

Browser

Chrome Web Storage

Parsed & presented in Investigation Hub

Browser

Chrome Form History

Parsed & presented in Investigation Hub

Browser

Edge Form History

Parsed & presented in Investigation Hub

Browser

Opera Form History

Parsed & presented in Investigation Hub

Browser

Vivaldi Form History

Parsed & presented in Investigation Hub

Browser

Brave Form History

Parsed & presented in Investigation Hub

Browser

QQ Form History

Parsed & presented in Investigation Hub

Browser

Chrome Thumbnails

Parsed & presented in Investigation Hub

Browser

Edge Thumbnails

Parsed & presented in Investigation Hub

Browser

Opera Thumbnails

Parsed & presented in Investigation Hub

Browser

Vivaldi Thumbnails

Parsed & presented in Investigation Hub

Browser

Brave Thumbnails

Parsed & presented in Investigation Hub

Browser

QQ Thumbnails

Parsed & presented in Investigation Hub

Browser

Chrome Favicons

Parsed & presented in Investigation Hub

Browser

Edge Favicons

Parsed & presented in Investigation Hub

Browser

Opera Favicons

Parsed & presented in Investigation Hub

Browser

Vivaldi Favicons

Parsed & presented in Investigation Hub

Browser

Brave Favicons

Parsed & presented in Investigation Hub

Browser

QQ Favicons

Parsed & presented in Investigation Hub

Browser

Chrome Login Data

Parsed & presented in Investigation Hub

Browser

Edge Login Data

Parsed & presented in Investigation Hub

Browser

Opera Login Data

Parsed & presented in Investigation Hub

Browser

Vivaldi Login Data

Parsed & presented in Investigation Hub

Browser

Brave Login Data

Parsed & presented in Investigation Hub

Browser

QQ Login Data

Parsed & presented in Investigation Hub

Browser

Chrome Sessions

Parsed & presented in Investigation Hub

Browser

Edge Sessions

Parsed & presented in Investigation Hub

Browser

Opera Sessions

Parsed & presented in Investigation Hub

Browser

Brave Sessions

Parsed & presented in Investigation Hub

Browser

Vivaldi Sessions

Parsed & presented in Investigation Hub

Browser

QQ Sessions

Parsed & presented in Investigation Hub

Browser

Chrome Browsing History

Parsed & presented in Investigation Hub

Browser

Firefox Browsing History

Parsed & presented in Investigation Hub

Browser

IE 7,8,9 Browsing History

Parsed & presented in Investigation Hub

Browser

IE 10,11, Edge Browsing History

Parsed & presented in Investigation Hub

Browser

Opera Browsing History

Parsed & presented in Investigation Hub

Browser

Brave Browsing History

Parsed & presented in Investigation Hub

Browser

Vivaldi Browsing History

Parsed & presented in Investigation Hub

Browser

QQ Browsing History

Parsed & presented in Investigation Hub

Browser

Chrome Downloads

Parsed & presented in Investigation Hub

Browser

Edge Downloads

Parsed & presented in Investigation Hub

Browser

Firefox Downloads

Parsed & presented in Investigation Hub

Browser

Opera Downloads

Parsed & presented in Investigation Hub

Browser

Brave Downloads

Parsed & presented in Investigation Hub

Browser

Vivaldi Downloads

Parsed & presented in Investigation Hub

Browser

QQ Downloads

Parsed & presented in Investigation Hub

Browser

Firefox Cookies

Parsed & presented in Investigation Hub

NTFS

$MFT as CSV

Parsed & saved as CSV

NTFS

$MFT

File collected

NTFS

$MFT Mirror

File collected

NTFS

USN Journal as CSV

Parsed & saved as CSV

NTFS

$Log File

File collected

NTFS

$USN Journal

File collected

NTFS

$Boot

File collected

NTFS

USN Journal $Max

File collected

NTFS

$Secure:$SDS

File collected

NTFS

$TxfLog $Top:$T

File collected

Registry

Registry Hives

File collected

Registry

Old Registry Hives

File collected

Registry

ShellBags

Parsed & presented in Investigation Hub

Registry

AppCompactCache

Parsed & presented in Investigation Hub

Registry

UserAssist

Parsed & presented in Investigation Hub

Registry

TypedPaths

Parsed & presented in Investigation Hub

Registry

FirstFolder

Parsed & presented in Investigation Hub

Registry

RecentDocs

Parsed & presented in Investigation Hub

Registry

WordWheelQuery

Parsed & presented in Investigation Hub

Registry

FileExts

Parsed & presented in Investigation Hub

Registry

ShellFolders

Parsed & presented in Investigation Hub

Registry

RunMRU

Parsed & presented in Investigation Hub

Registry

Map Network Drive MRU

Parsed & presented in Investigation Hub

Registry

TypedURLs

Parsed & presented in Investigation Hub

Registry

OfficeMRU

Parsed & presented in Investigation Hub

Registry

AppPaths

Parsed & presented in Investigation Hub

Registry

CIDSizeMRU

Parsed & presented in Investigation Hub

Registry

LastVisitedPidlMRU

Parsed & presented in Investigation Hub

Registry

OpenSavePidlMRU

Parsed & presented in Investigation Hub

Registry

Winrar History

Parsed & presented in Investigation Hub

Network

DNS Cache

Parsed & presented in Investigation Hub

Network

TCP Table

Parsed & presented in Investigation Hub

Network

UDP Table

Parsed & presented in Investigation Hub

Network

ARP Table

Parsed & presented in Investigation Hub

Network

IPv4 Routes

Parsed & presented in Investigation Hub

Network

Network Adapters

Parsed & presented in Investigation Hub

Network

Network Shares

Parsed & presented in Investigation Hub

Network

Hosts

File collected

Event Logs

EVT Files

File collected

Event Logs

EVTX Files

File collected

Event Logs

EVT Records

Parsed & presented in Investigation Hub

Process Execution

Prefetch Files

Parsed & presented in Investigation Hub

Process Execution

SRUM

Parsed & presented in Investigation Hub

Process Execution

Windows Timeline

Parsed & presented in Investigation Hub

Process Execution

AmCache

Parsed & presented in Investigation Hub

Process Execution

Recent File Cache

File collected

Process Execution

Parse LNK Files

Parsed & presented in Investigation Hub

Process Execution

Collect LNK Files

File collected

Other Evidence

ETL

File collected

Other Evidence

CLR

File collected

Other Evidence

Jump List

File collected

Other Evidence

Windows Index Search

File collected

Other Evidence

Superfetch

File collected

Other Evidence

WBEM

File collected

Other Evidence

INF Setup

File collected

Other Evidence

SDB

File collected

Other Evidence

Powershell Logs

File collected

Other Evidence

Powershell ConsoleHost History

Parsed & presented in Investigation Hub

Other Evidence

Thumbcache

File collected

Other Evidence

Iconcache

File collected

Other Evidence

RDP Cache

File collected

Windows Artifact List:

CategoryNameCollection Type

Server

Apache Logs

File collected

Server

MongoDB Logs

File collected

Server

IIS Logs

File collected

Server

MSSQL Logs

File collected

Server

Microsoft Exchange Logs

File collected

Server

DHCP Server Logs

File collected

Server

DNS Server Logs

File collected

Server

Active Directory Logs

File collected

Microsoft Applications

Microsoft Photos

File collected

Microsoft Applications

Cortana History

File collected

Microsoft Applications

Microsoft Store Applications List

File collected

Microsoft Applications

Microsoft Stick Notes

File collected

Microsoft Applications

Microsoft Maps

File collected

Microsoft Applications

Microsoft Voice Record History

File collected

Microsoft Applications

Windows Notification History

File collected

Microsoft Applications

Search History

File collected

Microsoft Applications

Microsoft People

File collected

Microsoft Applications

Microsoft Calendar

File collected

Communication

Discord Desktop Cache

File collected

Communication

Microsoft Mail

File collected

Communication

Microsoft Outlook

File collected

Communication

Mozilla Thunderbird

File collected

Communication

Skype Databases

File collected

Communication

Skype Media

File collected

Communication

Telegram Desktop Data

File collected

Communication

Telegram Desktop Download

File collected

Communication

WhatsApp Desktop Cache

File collected

Communication

WhatsApp Desktop Cookie

File collected

Communication

Windows Live Mail User Settings

File collected

Communication

Zoom Databases

File collected

Communication

Zoom Media

File collected

Remote Desktop/Management Tools

Action1 RMM Logs

File collected

Remote Desktop/Management Tools

AmmyAdmin Logs

File collected

Remote Desktop/Management Tools

AnyDesk Logs

File collected

Remote Desktop/Management Tools

GoTo Logs

File collected

Remote Desktop/Management Tools

Kaseya Logs

File collected

Remote Desktop/Management Tools

Level Logs

File collected

Remote Desktop/Management Tools

LogMein Logs

File collected

Remote Desktop/Management Tools

RealVNC Logs

File collected

Remote Desktop/Management Tools

RemComSvc Logs

File collected

Remote Desktop/Management Tools

Remote Utilities Logs

File collected

Remote Desktop/Management Tools

ScreenConnect (ConnectWise Control) Application Data

File collected

Remote Desktop/Management Tools

Splashtop Logs

File collected

Remote Desktop/Management Tools

Supremo Remote Desktop Logs

File collected

Remote Desktop/Management Tools

Teamviewer Logs

File collected

Remote Desktop/Management Tools

TightVNC Logs

File collected

Remote Desktop/Management Tools

Ultraviewer Logs

File collected

Remote Desktop/Management Tools

UltraVNC Logs

File collected

Remote Desktop/Management Tools

Xeox Logs

File collected

Remote Desktop/Management Tools

ZohoAssist Logs

File collected

Social Artifacts

Twitter Databases

File collected

Social Artifacts

Twitter Cache

File collected

Social Artifacts

Facebook Databases

File collected

Social Artifacts

Facebook Cache

File collected

Social Artifacts

Linkedin Cache

File collected

Social Artifacts

Spotify Recently Played List

File collected

Social Artifacts

Spotify Cache

File collected

Productivity Artifacts

Sublime Text Sessions

File collected

Productivity Artifacts

Notepad++ Sessions

File collected

Productivity Artifacts

OpenVPN Config

File collected

Productivity Artifacts

Everything History

File collected

Productivity Artifacts

Evernote Databases

File collected

Productivity Artifacts

Evernote Drag and Drop Files

File collected

Productivity Artifacts

Evernote Logs

File collected

Utilities Artifacts

iTunes Backups

File collected

Utilities Artifacts

VMware Config

File collected

Utilities Artifacts

VMware Drag and Drop Files

File collected

Utilities Artifacts

VMware Logs

File collected

Developer Tools

FileZilla Sessions

File collected

Developer Tools

Visual Studio Team Explorer Config

File collected

Developer Tools

GitHub Desktop Databases

File collected

Developer Tools

GitHub Desktop Cache

File collected

Developer Tools

GitHub Desktop Logs

File collected

Developer Tools

WSL

File collected

Developer Tools

Tortoise Git Logs

File collected

Cloud Artifacts

Google Drive Databases

File collected

Cloud Artifacts

Dropbox Databases

File collected

Cloud Artifacts

Dropbox Logs

File collected

Cloud Artifacts

Dropbox Cache

File collected

Cloud Artifacts

OneDrive Logs

File collected

Antivirus Logs

AVG Logs

File collected

Antivirus Logs

Avast Logs

File collected

Antivirus Logs

Avira Logs

File collected

Antivirus Logs

Bitdefender Logs

File collected

Antivirus Logs

Carbon Black Logs

File collected

Antivirus Logs

Cisco AMP Logs

File collected

Antivirus Logs

ComboFix

File collected

Antivirus Logs

Cybereason Logs

File collected

Antivirus Logs

Cylance Logs

File collected

Antivirus Logs

Deep Instinct Logs

File collected

Antivirus Logs

Elastic Logs

File collected

Antivirus Logs

Eset Logs

File collected

Antivirus Logs

F-Secure Logs

File collected

Antivirus Logs

FireEye Logs

File collected

Antivirus Logs

HitmanPro Logs

File collected

Antivirus Logs

MalwareBytes Logs

File collected

Antivirus Logs

McAfee Logs

File collected

Antivirus Logs

Palo Alto Logs

File collected

Antivirus Logs

RogueKiller Reports

File collected

Antivirus Logs

SentinelOne Logs

File collected

Antivirus Logs

Sophos Logs

File collected

Antivirus Logs

Sourcefire FireAMP Logs

File collected

Antivirus Logs

SUPERAntiSpyware Logs

File collected

Antivirus Logs

Symantec Logs

File collected

Antivirus Logs

Tanium Logs

File collected

Antivirus Logs

TotalAv Logs

File collected

Antivirus Logs

Trend Micro Logs

File collected

Antivirus Logs

VIPRE Logs

File collected

Antivirus Logs

Webroot Logs

File collected

Antivirus Logs

Windows Defender Logs

File collected

Last updated