windows-forensic-artifacts for mapping Windows DFIR evidence

A curated handbook cataloging 66 Windows forensic artifacts across registry, filesystem, event log, and memory sources, helping authorized examiners correlate evidence during incident response and forensic investigations.

Tool	Psmths/windows-forensic-artifacts — a reference handbook of Windows forensic artifacts with locations, parsing tools, and interpretation guidance
Category	Digital forensics reference / DFIR knowledge base
Primary Use	Looking up which Windows artifacts — Prefetch, AmCache.hve, ShimCache, SRUM, event IDs like 4624 and 4688 — answer a specific investigative question, and pivoting between them via shared fields such as Logon ID
Safe Use	Intended for authorized forensic investigators, incident responders, and defensive analysts examining systems they are contracted or permitted to investigate
Telemetry Note	Purely a documentation resource; it executes nothing and leaves no footprint, but it maps exactly the artifacts defenders monitor, making it equally useful for hardening telemetry coverage

Most DFIR knowledge on Windows lives scattered across blog posts, tool manuals, and hard-won case notes. Psmths/windows-forensic-artifacts consolidates that into a single MIT-licensed handbook, currently cataloging 66 forensic artifacts with a badge tracking the count. For each artifact the repository documents where it lives on disk or in the registry, which tools can parse it, and — the part that distinguishes it from a bare cheat sheet — how to actually interpret the parsed output during an investigation. At roughly 506 stars and tagged with topics like dfir, forensic-analysis, and windows-11, it has clearly resonated with practitioners who want one canonical place to look things up.

The guide opens with a taxonomy that frames everything else: Windows forensic evidence falls into four categories — registry, filesystem, event log, and memory. Registry artifacts live in hives that are loaded into memory while the system runs and flushed to disk at shutdown. Filesystem artifacts are a product of NTFS behavior. Event log artifacts are primarily audit records from the OS and applications, and memory artifacts must be captured from a live system, with the README explicitly noting the exceptions that survive on disk: page files and hibernation files. This framing matters operationally, because it dictates collection methodology before any parsing begins.

What makes the repository more than a list is its organizational scheme. Rather than grouping by source, artifacts are indexed by the investigative question they answer. The Execution category breaks down into sub-questions like command line options, first executed, last executed, process tree, execution time, and simple evidence of execution. Under 'Evidence of Execution' alone, the guide enumerates sixteen sources: AmCache.hve, Prefetch, ShimCache, the SRUM database, Background Activity Monitor (BAM/DAM), Security/4688 process-creation events, Detection History Files, scheduled task artifacts, PcaAppLaunchDic.txt from the Program Compatibility Assistant, tracing registry keys, Microsoft-Windows-Shell-Core/Operational/9707, Security/5156 WFP connection events, AutomaticDestinations jump lists, and Windows Error Reporting (.WER) files.

The correlation methodology the README describes is where a senior examiner will find the real value. The guide explicitly shines, in its own words, when it is time to tie separate artifacts together based on shared datapoints. The worked example: if an attacker logged into an endpoint around a known time, the analyst starts with 4624 successful logon events and extracts the Logon ID; the Account Activity section then lists every artifact carrying that field, letting the analyst pivot from logon to everything that session touched. A second example follows the same logic for a malicious file — when was it created, when first executed, and which Logon ID is associated with its 4688 execution record. The README describes this as building a mental map of artifact relationships, advice distilled from years of forensic experience.

The Execution sub-sections reward close reading. For 'First Executed', the guide points at Prefetch, AmCache.hve, scheduled task files, the TaskScheduler/Operational log, PowerShell/Operational/4104 script block logging, and AutomaticDestinations jump lists — a set that covers both the classic application-evidence trio and newer sources examiners routinely forget. For 'Last Executed', Prefetch appears again alongside BAM/DAM and PcaAppLaunchDic.txt, which is a genuinely useful distinction; many references blur first and last execution evidence together. Command line options, process tree, and execution time each get their own cross-referenced lists, with 4688 and 9707 events recurring as the high-fidelity sources.

Account Activity coverage is similarly question-driven: creation time maps to the SAM hive and Security/4720 events; group membership to the SAM hive and a dedicated group membership registry key; last login to the SAM hive; and login history to 4778, 4648, 4624, and 4625 events. The inclusion of 4648 (explicit credential logon) alongside the standard success/failure pair signals awareness of lateral-movement investigations, since 4648 is often the strongest indicator of a compromised account being used to access remote resources. The Logon ID index is the connective tissue that makes these pivots possible in practice.

The File Activity category indexes artifacts by creation, deletion, hash, last modified, origin, path, and size — essentially the super-timeline dimensions. The README notes that artifacts may be parsed individually at the analyst's discretion or consolidated into 'super timelines' with forensic software such as log2timeline, correctly crediting the Plaso ecosystem as the standard consolidation path. This is a sensible workflow note: the handbook tells you which artifacts answer which questions, and timeline tools tell you how to fuse them at scale.

Network Activity is broken into evidence of network activity, destination and source identification, transmit volume, plus dedicated browser activity, firewall activity, and wireless activity sections. Browser Activity gets its own top-level treatment covering history and bookmarks. Entries like TerminalServices-RDPClient/Operational/1024 (RDP client connection attempts) appearing under both process-tree and network questions illustrates the deliberate cross-referencing: the same artifact is indexed everywhere it is evidentially relevant, so the analyst does not need to memorize which category a source belongs to.

Notably, the repository goes beyond raw artifact cataloging into behavioral mapping. A section titled 'Artifact Behavioral Mappings' maps artifacts to MITRE ATT&CK tactics — TA0002 Execution, TA0003 Persistence, and TA0008 Lateral Movement. This bridges the gap between classic disk-and-registry forensics and the ATT&CK framework that modern incident response reporting is written in, letting an examiner translate 'I found scheduled task file tampering' directly into a persistence finding. There is also a System Enumeration Artifacts section and coverage of Group Policy activity and user activity, including winget — a relatively novel source reflecting modern Windows 11 package management behavior.

The repository labels itself work-in-progress via a Repostatus badge, so examiners should expect the catalog to keep growing rather than treat the 66-artifact count as final. There is nothing to install; consuming it is a matter of cloning or browsing the markdown files in the main branch. For teams, the practical adoption pattern is to keep it open during triage as the authoritative 'where do I look next' index, and to use its behavioral mappings as a completeness check when drafting findings.

It is worth stating the flip side for defenders: a catalog that tells investigators which artifacts are most evidentially rich also tells blue teams which telemetry to preserve and monitor. The recurring importance of 4688 with command-line logging, 4104 script block logging, 4624 with logon ID capture, and 5156 connection events in this guide is effectively a prioritized list of audit-policy settings. If those are not enabled and retained in your environment, much of what this handbook helps reconstruct will simply never have been recorded.

For authorized professionals — staff incident responders, consultants under engagement, and forensic students building competence — Psmths/windows-forensic-artifacts fills the gap between raw tool output and investigative judgment. It documents where evidence lives, which parsers extract it, how to interpret the results, and, most distinctively, how to pivot between artifacts using shared fields like Logon ID. As a defensive reference it doubles as a telemetry coverage checklist, which is a rare property for a forensics resource and one that makes it worth a star even for analysts who never expect to image a disk.

Official project repository for Psmths/windows-forensic-artifacts.

Download Tool

Educational analysis for authorized security professionals. Use only in controlled, authorized environments.