The Presenter

Introduction to Forensic Expertise

Hijabi Icon

Toqa Ezzatly

Cybersecurity Engineer

Professional Profile

Digital Forensics enthusiast and aspiring Red Teamer with a strong foundation in Windows OS internals, cybersecurity, and network forensics. This reference guide provides practical insights into Windows artifacts and investigative methodologies, reflecting real-world bug hunting and security analysis experience.

toqaezzatly@gmail.com

https://toqaezzatly.github.io/toqaezzatly/

Program Execution

Evidence of applications triggered on the system

UserAssist

NTUSER.DAT\Software\...\UserAssist

Tracks GUI-based app launches.

Deep Tech Specs

Shimcache

SYSTEM\...\AppCompatCache

Identifies executables present/run.

Deep Tech Specs

Prefetch (.pf)

C:\Windows\Prefetch

Optimization logs with run counts.

Deep Tech Specs

Amcache.hve

C:\Windows\AppCompat\Programs\Amcache.hve

Full path & SHA1 execution history.

Deep Tech Specs

Windows Timeline

ActivitiesCache.db

Recent app & file usage (WIN+TAB).

Deep Tech Specs

RecentApps

NTUSER.DAT\...\RecentApps

Tracks recent GUI executions.

Deep Tech Specs

BAM / DAM

SYSTEM\...\Services\bam\UserSettings

Modern Win10 Background execution.

Deep Tech Specs

File & Folder Access

Evidence of user knowledge and specific data access

Shell Bags

USRCLASS.DAT\...\Shell\Bags

Folder browsing history (Local/USB).

Deep Tech Specs

LNK Files

%USERPROFILE%\...\Recent

Proves file opening via shortcuts.

Deep Tech Specs

RecentDocs

NTUSER.DAT\...\RecentDocs

Recently opened files & folders.

Deep Tech Specs

Office FileMRU

NTUSER.DAT\...\Office

MS Office document access history.

Deep Tech Specs

Thumbcache

%USERPROFILE%\...\Explorer

Viewed images & documents.

Deep Tech Specs

Thumbs.db

Hidden image folders

Legacy thumbnail artifacts.

Deep Tech Specs

Jump Lists

%USERPROFILE%\...\AutomaticDestinations

Taskbar frequent & pinned items.

Deep Tech Specs

Browsing Activity

Online history, downloads, and web-based exfiltration

Browser History

Chrome: History | IE: WebCacheV*.dat

URLs visited, visit counts, and timestamps.

Browser Downloads

Chrome: Downloads | Firefox: downloads.sqlite

Tracks downloaded files and source URLs.

Browser Cookies

Chrome: Local Storage | Firefox: cookies.sqlite

User session and authentication tracking.

Browser Cache

Chrome: Cache | IE: Temporary Internet Files

Cached resources and page remnants.

Session Restore

Chrome/Firefox/IE session files

Open tabs and session state for browser recovery.

Zone.Identifier (ADS)

NTFS Alternate Data Streams

Proves downloaded file origin and trust zone.

Browsing Activity

Online history, downloads, and web-based exfiltration

Browser History

Chrome: History | IE: WebCacheV*.dat

URLs visited, visit counts, and timestamps.

Browser Downloads

Chrome: Downloads | Firefox: downloads.sqlite

Tracks downloaded files and source URLs.

Browser Cookies

Chrome: Local Storage | Firefox: cookies.sqlite

User session and authentication tracking.

Browser Cache

Chrome: Cache | IE: Temporary Internet Files

Cached resources and page remnants.

Session Restore

Chrome/Firefox/IE session files

Open tabs and session state for browser recovery.

Zone.Identifier (ADS)

NTFS Alternate Data Streams

Proves downloaded file origin and trust zone.

External Devices

USB connections and exfiltration attempts

USBSTOR Registry

SYSTEM\CurrentControlSet\Enum\USBSTOR

Vendor, Product, and Serial Numbers.

SetupAPI Logs

C:\Windows\inf\setupapi.dev.log

First connection timestamps.

Accounts & Authentication

Logons, remote access, persistence

Logon Events

Security.evtx

Successful & failed logons.

Deep Tech Specs

RDP Usage

Event IDs 4778/4779

Remote interactive sessions.

Deep Tech Specs

Service Events

System & Security Logs

Persistence & malware installs.

Deep Tech Specs

Deletion & Cleanup

Evidence removal & anti-forensics traces

Recycle Bin

$Recycle.Bin

Deleted files metadata & timestamps.

Deep Tech Specs

USN Journal

$Extend\$UsnJrnl

File create, delete, overwrite actions.

Deep Tech Specs

Prefetch Deletion

C:\Windows\Prefetch

Execution traces even after file removal.

Deep Tech Specs

Event Log Clearing

Security.evtx

Manual log deletion & tampering.

Deep Tech Specs

Network & Location

Physical presence & network association

NetworkList

SOFTWARE\...\NetworkList

SSID, gateway MAC, VPNs.

Deep Tech Specs

WLAN AutoConfig

WLAN-AutoConfig.evtx

Wireless connection timeline.

Deep Tech Specs

SRUM

SRUDB.dat

Long-term app & network usage.

Deep Tech Specs

DFIR Methodology

Structured investigation approach

Triage

Scope, volatility & evidence prioritization.

Deep Tech Specs

Timeline Analysis

Correlating multi-source artifacts.

Deep Tech Specs

Artifact Correlation

Cross-validating evidence.

Deep Tech Specs

Reporting

Clear, defensible forensic conclusions.

Deep Tech Specs