Windows Forensics
Artifacts and techniques for Windows systems.
-
Forensic timeline with plaso (log2timeline) on Windows
How to build a super timeline with plaso on a Windows workstation: extract events with log2timeline, filter them with psort and review them in a spreadsheet. Updated with the Docker workflow.
-
How to find the Windows installation date
Five ways to find when Windows was installed — registry, systeminfo, WMI, the CSC folder and the Source OS keys — and why feature updates on Windows 10 and 11 can fool you.