Windows Forensic Artifacts: Registry, Event Logs, and Prefetch
Identify key Windows artifacts that reveal attacker activity — registry run keys, Security event log entries, and Prefetch files that show what ran and when.
Windows Forensic Artifacts: Registry, Event Logs, and Prefetch is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Windows Artifacts Matter
Windows systems generate rich forensic artifacts that record user activity, program execution, file access, and network connections. These artifacts exist because Windows was designed for performance and functionality — features like Prefetch (faster app launches) and the Registry (centralized configuration) create forensic records as side effects. Skilled analysts know where to look for evidence that attackers try to hide or delete. Understanding Windows artifacts is fundamental to endpoint forensics.
The Windows Registry as a Forensic Source
The Windows Registry is a hierarchical database storing OS and application configuration settings. It is a goldmine for forensic investigators because it records: recently accessed files and URLs, USB devices ever connected to the system, installed programs and uninstall history, autorun/startup entries (persistence mechanisms), user activity patterns, and network connections. The registry is stored in hive files (NTUSER.DAT, SYSTEM, SOFTWARE, SAM, SECURITY) that persist on disk.
# Key forensic Registry locations
# Persistence (autorun) locations:
# HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
# HKLM\SYSTEM\CurrentControlSet\Services (services/drivers)
# Recently accessed files (user activity):
# HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
# HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
# USB devices ever connected:
# HKLM\SYSTEM\CurrentControlSet\Enum\USBSTORRegistry Persistence Keys
Attackers use registry autorun keys to establish persistence — ensuring their malware relaunches after a reboot. The most commonly abused keys are under HKLM\...\Run (runs for all users) and HKCU\...\Run (runs only for the current user). Investigators examine these keys for unexpected entries, and defenders use tools like Autoruns (Sysinternals) to enumerate and compare against known-good baselines. Any entry pointing to suspicious locations (%TEMP%, %APPDATA%) warrants investigation.
# Examine autorun keys (PowerShell)
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
Get-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
# Look for entries pointing to unusual paths:
# 'svchost32' = 'C:\Users\User\AppData\Local\Temp\evil.exe'
# vs legitimate:
# 'SecurityHealth' = '%windir%\system32\SecurityHealthSystray.exe'
# Autoruns.exe (Sysinternals) shows ALL autostart locationsWindows Event Logs
The Windows Event Log records system, security, and application events. For security forensics, the Security event log is most critical — it captures authentication events, account management changes, privilege use, and policy changes. Key locations: %SystemRoot%\System32\winevt\Logs\. Event logs use a binary format (.evtx) readable with Event Viewer or forensic tools. Attackers often attempt to clear event logs — a cleared Security log itself generates Event ID 1102, which should trigger an immediate alert.
# Query Security event log for failed logins (PowerShell)
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4625} |
Select-Object TimeCreated, Message |
Where-Object { $_.TimeCreated -gt (Get-Date).AddDays(-7) }
# Key Security Event IDs for forensics:
# 4624: Successful logon (logon type matters!)
# 4625: Failed logon
# 4634/4647: Logoff
# 4720: User account created
# 4732: Member added to security-enabled group
# 1102: Audit log cleared (attacker cleanup!)Logon Types in Event ID 4624
Event ID 4624 (Successful Logon) includes a logon type field that reveals HOW the logon occurred. Logon types have significant forensic meaning: Type 2 = interactive (user at keyboard), Type 3 = network (file share, remote API), Type 4 = batch (scheduled task), Type 5 = service (service started), Type 7 = unlock, Type 10 = remote interactive (RDP), Type 11 = cached credentials. Network logons (type 3) appearing from external IPs indicate lateral movement or remote access.
# PowerShell: Find RDP logons (Type 10) from external IPs
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4624} |
Where-Object {
$msg = $_.Message
$msg -match 'Logon Type:\s+10' -and
$msg -match 'Source Network Address:\s+(?!192\.168|10\.|172\.1[6-9]|172\.2[0-9]|172\.3[0-1])'
} |
Select-Object TimeCreated, MessageWindows Prefetch Files
Prefetch files (%SystemRoot%\Prefetch\*.pf) are created by Windows to speed up application launches by caching data about recently executed programs. Each Prefetch file records: the executable name, the full path, the last run time, up to 8 execution timestamps (in Windows 8+), the run count, and files and directories referenced by the executable. For forensics, Prefetch proves a program was executed even if the program itself has been deleted — critical for proving malware execution.
# List Prefetch files with last run times (PowerShell)
Get-ChildItem C:\Windows\Prefetch\*.pf |
Select-Object Name, LastWriteTime, Length |
Sort-Object LastWriteTime -Descending
# Parse with PECmd (Eric Zimmerman's tool) for full details:
PECmd.exe -d C:\Windows\Prefetch --csv C:\forensics\prefetch_output
# Output shows: executable path, last 8 run times, run count,
# files and directories accessed during executionShimcache and Amcache
Shimcache (AppCompatCache) records executables that have been run on the system, stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache. It captures the file path and last modified time. Amcache.hve (in %SystemRoot%\AppCompat\Programs\) is a registry hive that records executed programs, their SHA-1 hash, and the first time they were run. Both are valuable for proving malware execution even when the malware file has been deleted.
# Parse ShimCache with AppCompatCacheParser.exe (Eric Zimmerman)
AppCompatCacheParser.exe --csv C:\forensics
# Parse Amcache with AmcacheParser.exe
AmcacheParser.exe -f C:\Windows\AppCompat\Programs\Amcache.hve \
--csv C:\forensics
# Look for executables in unusual locations:
# C:\Users\username\AppData\Local\Temp\*.exe
# C:\Users\username\Downloads\*.exe
# C:\ProgramData\*.exe (malware staging area)Windows Event Forensics: Lateral Movement
Detecting lateral movement requires correlating events across multiple systems. Key patterns: Event 4648 (Logon with explicit credentials) on the source system shows the attacker using runas or Pass-the-Hash tools. Event 4624 Type 3 on the target system shows the successful network authentication. Event 7045 (New service installed) on the target shows attacker persistence establishment via PsExec or similar remote execution tools. Correlating timestamps across systems in the SIEM reveals the lateral movement path.
# SIEM query: detect PsExec lateral movement pattern
# Source system: Event 4648 (explicit creds)
# Target system: Event 4624 Type 3 + Event 7045 (PSEXESVC service)
# PowerShell: find PSEXESVC service creation (attacker lateral movement)
Get-WinEvent -FilterHashtable @{LogName='System'; Id=7045} |
Where-Object { $_.Message -match 'PSEXESVC' } |
Select-Object TimeCreated, MessageLNK Files and Jump Lists
LNK (shortcut) files are created automatically by Windows when a user opens a file, recording the target file path, creation and modification times, and volume serial number — even if the target file has since been deleted. Jump Lists record recently and frequently accessed files per application, stored in %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\. These artifacts reveal attacker file access and can identify files that were exfiltrated or accessed during an intrusion, even after the files themselves were cleaned up.
MFT and Deleted File Recovery
The Master File Table (MFT) is the NTFS filesystem index recording metadata for every file and directory — including deleted files. When a file is 'deleted' in Windows, the MFT entry is marked as available for reuse, but the file data may remain on disk until overwritten. Forensic tools (Autopsy, FTK) can recover MFT entries for deleted files and attempt to recover their content. This is critical for recovering attacker-deleted malware, logs, or exfiltrated data staging files.
# Analyze the MFT to find deleted files
# Using Autopsy or The Sleuth Kit (tsk)
fls -r /forensics/disk.img | grep '\*' # deleted files marked with *
# Recover a specific deleted file by inode number
icat /forensics/disk.img 12345 > /forensics/recovered_file
sha256sum /forensics/recovered_file
# Parse MFT with MFTECmd.exe (Eric Zimmerman)
MFTECmd.exe -f C:\$MFT --csv C:\forensics\mft_outputBrowser Artifacts and User Activity
Web browsers leave forensic artifacts that reveal attacker or insider activity online. Browser history records visited URLs with timestamps. Download history shows what files were retrieved from the web. Cached files may contain copies of web pages or files the attacker viewed. Saved credentials in the browser can reveal what accounts the attacker accessed. These artifacts are stored in profile directories (%LOCALAPPDATA%\Google\Chrome\User Data\Default\) and can be parsed with tools like ChromeCacheView or BrowsingHistoryView to reconstruct online attacker activity.
# Browser artifact locations (Windows)
# Chrome history database:
# %LOCALAPPDATA%\Google\Chrome\User Data\Default\History
# (SQLite database)
# Parse with sqlite3
sqlite3 History 'SELECT url, title, last_visit_time FROM urls ORDER BY last_visit_time DESC LIMIT 50'
# Firefox places.db (SQLite):
# %APPDATA%\Mozilla\Firefox\Profiles\*.default\places.sqlite
# BrowsingHistoryView.exe (Nirsoft) parses all browsers at onceQuick Check
Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.
Lesson Recap
In this lesson you learned: the Windows Registry records persistence mechanisms, USB history, and user activity in forensically valuable hive files, Security Event Log Event IDs 4624/4625/4720/1102 are critical for authentication and account activity forensics, and Prefetch, Shimcache, and Amcache prove program execution even after malware is deleted. Next up we explore network and memory forensics.
Frequently asked questions
Is the “Windows Forensic Artifacts: Registry, Event Logs, and Prefetch” lesson free?
Yes — the full text of “Windows Forensic Artifacts: Registry, Event Logs, and Prefetch” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.
What will I learn in “Windows Forensic Artifacts: Registry, Event Logs, and Prefetch”?
Identify key Windows artifacts that reveal attacker activity — registry run keys, Security event log entries, and Prefetch files that show what ran and when. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cloud & IT Cert Prep?
No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Windows Forensic Artifacts: Registry, Event Logs, and Prefetch” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cloud & IT Cert Prep lesson?
Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Order of Volatility and Evidence Acquisition
- Chain of Custody and Legal Admissibility
- Windows Forensic Artifacts: Registry, Event Logs, and Prefetch
- Network and Memory Forensics