Windows Forensic Artifact Matrix & Evidence Guide

A quick-reference forensic triage matrix categorizing the primary Windows artifacts, their evidentiary value, and standard parsing tools.

🧭 Proof of Execution vs. File Knowledge

[!IMPORTANT] Forensic Distinction:

Execution Proof: Prefetch, Amcache, Shimcache, SRUM, Event 4688/4104. Proves the binary was loaded and executed on CPU.

Knowledge / Presence Proof: LNK files, Shellbags, Jumplists, OpenSavePidlMRU, $MFT record without prefetch. Proves the file existed or was viewed by a user, but not necessarily executed.

📊 The Master Forensic Artifact Matrix

Artifact	Default Disk Location	Forensic Evidence Provided	Parsing Toolchain
Prefetch (`.pf`)	`C:\Windows\Prefetch\`	Binary execution proof, run count, last 8 execution timestamps, loaded DLLs	`PECmd.exe` (Eric Zimmerman)
Shimcache (AppCompatCache)	`SYSTEM` registry hive: `CurrentControlSet\Control\Session Manager\AppCompatCache`	Full executable file path, last modified time, execution flag (Win10+)	`AppCompatCacheParser.exe`
Amcache (`Amcache.hve`)	`C:\Windows\appcompat\Programs\Amcache.hve`	SHA-1 binary hash, full path, first execution time, program version	`AmcacheParser.exe`
$MFT (Master File Table)	`C:\$MFT` (Raw NTFS)	All files on volume, `$STANDARD_INFORMATION` vs `$FILE_NAME` timestamps (Timestomp detection)	`MFTECmd.exe`
SRUM (System Resource Usage)	`C:\Windows\System32\sru\SRUDB.dat` + `SOFTWARE` hive	Bytes sent/received per application over network, CPU runtime across 30-60 days	`SrumECmd.exe`
Shellbags	`UsrClass.dat` (`Local Settings\Software\Microsoft\Windows\Shell\Bags`)	Folders viewed in Explorer, deleted directory names, removable media access	`SBECmd.exe`
LNK Files & Jump Lists	`%APPDATA%\Microsoft\Windows\Recent\`	Target path, target file MACB timestamps, volume serial number, original file size	`LECmd.exe`, `JLECmd.exe`
USN Journal	`C:\$Extend\$UsnJrnl:$J`	Complete chronological delta of file creations, deletions, renames, and writes	`MFTECmd.exe`

🕵️ Detecting Timestomping via $MFT

Adversaries often alter file creation and modification timestamps using tools like Cobalt Strike or PowerShell to blend malware with legitimate OS files.

The Mechanism

Each MFT file record possesses two primary attribute sets containing timestamps:

$STANDARD_INFORMATION ($SI):
- Displayed by Windows Explorer and common APIs.
- Trivially modified by userland utilities.
$FILE_NAME ($FN):
- Modified only by the NTFS kernel driver during creation, rename, or relocation.
- Cannot be modified by standard userland API calls without raw disk access.

+-------------------------------------------------------------+
| TIMESTOMP DETECTION RULE:                                   |
| If $SI Creation Time < $FN Creation Time,                  |
| or if $SI milliseconds are exactly .0000000 -> SUSPICIOUS   |
+-------------------------------------------------------------+

Rapid Parsing with MFTECmd

# Parse MFT and output CSV timeline with anomaly flags
MFTECmd.exe -f "C:\Forensics\C_\$MFT" --csv "C:\Forensics\Output" --csvf "mft_analysis.csv"

⚡ Prefetch Forensic Deep-Dive

Location: C:\Windows\Prefetch\*.pf
Naming format: [BINARY_NAME]-[HASH_OF_PATH].pf (e.g. CMD.EXE-AC752F10.pf).
Capacity:
- Windows 8+: Stores up to the last 8 execution timestamps.
- Stores total Run Count.
- Records all files, directories, and DLLs referenced by the process during the first 10 seconds of execution.

# Parse all prefetch files in an acquired triage folder
PECmd.exe -d "C:\Forensics\Triage\Prefetch" --csv "C:\Forensics\Output" --json "C:\Forensics\Output"

🌐 SRUM (System Resource Usage Monitor) for Exfiltration Analysis

When investigating data theft, SRUDB.dat tracks every byte an application pushed across network interfaces, even if the application deleted its logs and terminated.

# Parse SRUDB.dat to audit data transfer per executable
SrumECmd.exe -d "C:\Forensics\Triage\sru" --reg "C:\Forensics\Triage\config" --csv "C:\Forensics\Output"

Look for unexpected binaries (e.g. rclone.exe, megasync.exe, powershell.exe, or unquoted paths) with multi-gigabyte upload tallies.