CyCube
Intermediate

Artifacts Analysis

Windows artifact forensics: Prefetch, LNK, Recycle Bin, persistence mechanisms, and browser data to reconstruct timelines and user actions.

Duration
3h
Labs
4
Videos
4

Skills Acquired

  • Understand and analyze Prefetch artifacts for program execution evidence
  • Interpret Link (LNK) files to reconstruct file access history
  • Examine Recycle Bin structure and recover deleted files
  • Investigate persistence mechanisms such as Autoruns, services, and WMI
  • Analyze browser artifacts including history, cookies, cache, and downloads
  • Use forensic tools such as PECmd, LECmd, Autoruns, and Nirsoft utilities

Curriculum

  1. Windows Artifacts Analysis
    • Prefetch artifacts and PECmd usage
    • Link file analysis with LECmd
    • Recycle Bin structure and recovery methods
  2. User Activity Artifacts Analysis
    • ShimCache and AmCache analysis
    • Tools for parsing execution and installation artifacts
  3. Persistence Analysis
    • Registry Run keys and RunOnce
    • Scheduled tasks, services, and startup folders
    • WMI persistence and Autoruns tool usage
  4. Browser Artifacts Analysis
    • History, cookies, cache, and downloads
    • Artifact locations for Chrome, Edge, and Firefox
    • Reading browser data with DB Browser and Nirsoft tools

Included in these pathways