Forensic Integrations

AmCache

Windows

Tracks programs that have run on a computer, providing a history of application usage.

BAM/DAM

Windows

A Windows registry artifact that reliably tracks executed programs and links them directly to the specific user account that ran them.

Event Logs

Windows

The computer's diary, recording important system, security, and application events as they happen.

Jumplists

Windows

Reveals recently opened files, showing a history of a user's document and application access.

MFT

Windows

A master index of every file on the disk, including critical information about deleted files.

Microsoft 365

All

A comprehensive suite of cloud logs capturing user authentication, email routing, and application permissions within the tenant.

Prefetch

Windows

A performance-enhancing artifact that provides definitive proof of application execution, run counts, and the specific files accessed during launch.

Profile Lists

Windows

Identifies every user account that has logged into the computer and their associated profile folder.

PS History

Windows

A command log that reveals specific, advanced actions performed by administrators or sophisticated users.

Recent Lnks

Windows

Automatically created shortcuts that show which files a user has recently opened or accessed.

Recycle Bin

Windows

A critical repository of deleted files and their metadata, revealing exactly what a user attempted to remove and when.

Scheduled Tasks

Windows

A native Windows feature used to automate execution, frequently abused by adversaries for stealthy persistence and lateral movement.

Shell Bags

Windows

Remembers which folders a user has opened, creating a map of their navigation history.

ShimCache

Windows

A system compatibility record that serves as evidence of which programs have been executed.

Slack

All

A record of user messages and file transfers that provides evidence of conversations and insider threats.

SRUM

Windows

Details which applications used network data and CPU time, helping to track internet and program activity.

Startup Tasks

Windows

A critical record of applications and services configured to execute automatically at boot or user logon, frequently abused by malware to maintain persistence.

UserAssist

Windows

Tracks applications launched via the Windows graphical user interface, revealing specific user activity, run counts, and execution times.

USN Journal

Windows

A hidden system log that records changes made to files and directories, revealing a timeline of file creation, modification, and deletion.

Web Browser

All

A detailed log of websites visited and files downloaded, showing a user's online activity.