- Nationwide Digital Forensic & Cyber Investigation Services
When logs are gone, the disk still remembers. Windows records execution, file access, device connection, and data staging in dozens of artifacts that most intruders never think to clean, and that survive long after event logs have rolled over.
| Question | One line answer |
|---|---|
| Can you prove a program ran after it was deleted? | Often yes, through Prefetch, Amcache, ShimCache, and the background activity moderator keys. |
| Can you tell what folders someone browsed? | Shellbags record folder access, including on drives that are no longer attached. |
| Can you see how much data an application sent? | The system resource usage monitor database records per application bytes sent and received for roughly 30 days. |
| Do deleted files leave a trace? | Yes. The master file table and update sequence number journal record creation, rename, and deletion. |
| Are shadow copies useful? | Very. They can restore pre incident file and registry states unless the attacker deleted them. |
| Is a live triage enough? | For a rapid answer, sometimes. For litigation or a disputed claim, a full forensic image is the defensible path. |
| Term | What it means |
|---|---|
| Master file table | The index of every file on an NTFS volume, including names, sizes, and multiple time stamp sets. |
| Update sequence number journal | A rolling record of file system change operations such as create, rename, and delete. |
| Prefetch | Files Windows writes to speed application loading. They record run counts and recent execution times. |
| Amcache and ShimCache | Registry based records of program presence and execution, including path and, for Amcache, file hash. |
| Shellbags | Registry entries recording folder browsing, including network and removable volumes. |
| SRUM | The system resource usage monitor database, which logs per application network volume and execution over roughly a month. |
| Volume shadow copy | A point in time snapshot of a volume that can expose earlier versions of files and registry hives. |
Intruders delete their tools. Windows keeps writing about them anyway. A layered execution analysis uses several artifacts because each proves something slightly different, and agreement across them is what makes a finding defensible.
| Artifact | What it proves | Practical caveat |
|---|---|---|
| Prefetch | That a program ran, with run count and up to the last eight execution times | Disabled by default on servers and on some solid state configurations |
| Amcache.hve | Presence and first execution of a binary, with the file hash | Presence does not always equal execution; treat as corroboration |
| ShimCache | That a binary existed at a path with a given modification time | Does not record an execution time stamp of its own |
| Background activity moderator keys | Last execution time per user account | Windows client versions primarily |
| Event 4688 and Sysmon 1 | Execution with parent process and command line | Requires the corresponding auditing to have been enabled |
| Scheduled task and service entries | Persistence and automated re execution | Also visible in event logs 4698 and 7045 |
When four independent artifacts place the same binary on the same host in the same hour, the conclusion is durable. When one artifact stands alone, the report should say so plainly.
Most business breach questions eventually reduce to a single issue: what data did they touch, and did any of it leave. Windows offers several independent answers.
Deleted shadow copies, cleared logs, wiped free space, and time stamp manipulation are all detectable. So is the installation of a privacy cleaning utility on the day a resignation was submitted. Conduct evidence often matters as much to a court as the underlying data question.
Rebuilding a compromised server destroys artifacts that no cloud log replaces. We can perform defensible imaging onsite or remotely, nationwide.
Capture volatile memory first where the host is still running, then acquire a full disk image with write blocking or a validated remote agent.
Compute and record cryptographic hashes at acquisition and after transfer so integrity can be demonstrated later.
Record who acquired what, when, with which tool and version, and where the evidence has been stored since.
All examination occurs on verified working copies. The original image is never the working surface.
Every conclusion cites the artifact and the record supporting it, so an opposing expert can reproduce the analysis.
For virtual infrastructure, snapshot and disk export can substitute for physical imaging when documented properly. For cloud hosted workloads, provider level snapshot copied to an isolated forensic account is the accepted equivalent.
In an encryption event the practical questions are how they entered, how long they were inside, whether data was taken, and whether backups were targeted. Host forensics contributes directly to each.
Earliest attacker binary execution, first anomalous logon, and initial persistence establish the start of the intrusion window.
Credential dumping utilities, service installs, and administrative tool usage document how control expanded.
Shadow copy deletion and backup service tampering are recorded in process execution and event data.
Large archive creation, transfer utility execution, and network volume records inform whether exfiltration claims are credible.
File system records, journals, link files, and shadow copies routinely establish that a file existed, when it was created, and when it was removed.
A quick format leaves the majority of content recoverable. Even after reinstallation, useful artifacts frequently remain in unallocated space.
A scan reports what the product recognizes today. A forensic examination reconstructs what happened over time, including activity no product flagged.
Cloud logs cover the tenant. They do not record what an intruder ran on a file server, or what a departing employee copied to a thumb drive.
| Question | Logs alone | Host forensics | Both combined |
|---|---|---|---|
| When did the intrusion start? | Only if retention covers it | Often, through execution artifacts | Highest confidence |
| What tools were used? | Sometimes | Yes, including deleted binaries | Yes with corroboration |
| What files were accessed? | Rarely at file level | Yes, through access artifacts | Yes |
| Was a USB drive used? | No | Yes, with device serial numbers | Yes |
| Cost and time | Lower | Higher | Scoped to the disputed questions |
We image, examine, and testify. Businesses hire us when the internal team has reached the limit of what console dashboards can tell them, and when the answer has to hold up in front of an insurer, a regulator, or a judge.
Onsite or remote acquisition of servers, workstations, and virtual machines with full chain of custody documentation.
Reconstruction of what ran, what was opened, and what was copied, including activity that left no log entry.
Identification of specific external drives by serial number and correlation to the files accessed from them.
Detection of wiping utilities, shadow copy deletion, and time stamp manipulation, with an opinion on intent where supportable.
Carving and reconstruction of removed files and archives from unallocated space and shadow copies.
Clear written findings and court qualified testimony that explains complex artifacts to a lay audience.
Consultations are confidential. We work directly with affected businesses, with outside counsel, and with cyber insurance carriers and brokers nationwide.
Elite Digital Forensics is an independent digital forensics firm serving businesses, attorneys, and insurers nationwide. Our examiners include former law enforcement forensic examiners who have testified as court qualified expert witnesses in state and federal proceedings. We do not sell security software and we do not manage client networks, so our findings carry no conflict of interest when the question is whether an environment was adequately secured.
Every engagement follows documented chain of custody, defensible acquisition methods, and reporting written for attorney review, insurer submission, regulator response, or courtroom use. Work performed at the direction of counsel is generally treated as attorney work product prepared in anticipation of litigation. Call (833) 292-3733 or request a confidential consultation.
Prefetch, Amcache, ShimCache, background activity moderator registry keys, process creation events, and scheduled task or service entries. Each proves something slightly different, so examiners look for agreement across several rather than relying on one.
Often yes. Registry device keys record vendor, product, and serial number with connection times, and link files, jump lists, and shellbags tie specific documents to that volume. It usually cannot prove the contents were later opened elsewhere.
The system resource usage monitor database records per application bytes sent and received over roughly 30 days. It supports volume estimates but should be corroborated with firewall or proxy records where available.
For an internal question answered quickly, targeted collection may suffice. Where litigation, a disputed insurance claim, or regulatory scrutiny is realistic, a full image is what keeps the findings defensible and repeatable.
Sometimes, from unallocated space, from backups, or from virtual machine snapshots. The reliable answer is to image first and rebuild second, because reinstallation frequently overwrites exactly the regions of interest.
Mostly, with important exceptions. Prefetch is commonly disabled on servers, and user activity artifacts are sparser because interactive use is less frequent. Server analysis leans more on event logs, services, scheduled tasks, and the file system journal.
This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder