- Nationwide Digital Forensic & Cyber Investigation Services
Independent, court-qualified Windows forensic examiners for criminal defense, civil litigation, family law, and corporate investigations. We analyze digital evidence, user activity, files, logs, registry hives, and system artifacts on Windows 10 and Windows 11 computers, servers, and virtual machines.
Quick Answer. Windows forensics is the disciplined recovery, preservation, and analysis of digital evidence from Windows computers. A Windows forensic examination reconstructs which user account was active, which files were opened, created, modified, or deleted, which USB devices were connected, which programs ran, which websites were visited, and whether remote access occurred. Findings rely on registry hives (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat), Windows event logs, NTFS metadata (MFT, USN journal, $LogFile), Prefetch, Amcache, Shimcache, SRUM, BAM, Volume Shadow Copies, and browser data. When acquisition and analysis follow accepted procedures (write-blocked imaging, hash verification, documented chain of custody), the resulting findings are admissible under Federal Rule of Evidence 702 and Daubert.
Windows powers the majority of desktops, laptops, workstations, and business servers in the United States. That share is why Windows evidence appears in nearly every kind of matter we handle: employment disputes, trade secret theft, insider data exfiltration, unauthorized access allegations, matrimonial disputes, criminal defense, and cyber incident response. A properly scoped Windows forensic examination answers concrete, decision-ready questions:
Every action on a Windows computer leaves traces across multiple, independent artifacts. That redundancy is what makes Windows forensics reliable, because a single deleted or wiped artifact rarely defeats the analysis when four or five others corroborate the same event.
| Category | Primary artifacts | What it answers |
|---|---|---|
| Account activity | Security event log (4624, 4625, 4634, 4648, 4672, 4720), SAM hive, LogonUI | Who logged in, when, from where, using which credentials |
| User configuration | NTUSER.DAT, UsrClass.dat, SOFTWARE hive | Per-user preferences, installed apps, recent activity |
| File activity | $MFT, $LogFile, $UsnJrnl, LNK shortcuts, ShellBags, RecentDocs, jump lists | Files created, opened, modified, deleted, renamed |
| Program execution | Prefetch, Amcache.hve, Shimcache, BAM, DAM, SRUM, UserAssist | Which executables ran, when, and by which user |
| External devices | USBSTOR, MountedDevices, MountPoints2, setupapi.dev.log | Which USB drives, phones, cameras were connected |
| Remote access | TerminalServices-LocalSessionManager, RemoteConnectionManager, 4778/4779, RDPCache | Remote Desktop, remote assistance, and remote access tools |
| Internet activity | Chrome History, Edge WebCacheV01.dat, Firefox places.sqlite, IE index.dat | Sites visited, downloads, search terms, cached content |
| System state | Volume Shadow Copies, System Restore, hibernation file, pagefile | Historical states, deleted data, memory residue |
The Windows registry is a hierarchical database of configuration data that Windows and installed applications read and write continuously. For a forensic examiner, the registry is a chronological record of user behavior, hardware history, and program state. Five hives carry the bulk of the evidence.
Volume Shadow Copies routinely preserve older versions of registry hives, letting us compare state across days, weeks, or months. Registry timestamps and value data together produce hard evidence about what a specific user did on a specific machine.
Modern Windows records tens of thousands of structured events per day across roughly two dozen active event log files stored at C:\Windows\System32\winevt\Logs\*.evtx. The most forensically relevant channels are Security, System, Application, and specialized channels for RDP, PowerShell, task scheduling, and USB device installs. Event IDs that carry the most evidentiary weight include:
4624 logon success (logon type identifies interactive vs network vs RDP vs unlock)4625 logon failure (with reason and account name)4634 / 4647 logoff4648 logon using explicit credentials (runas)4672 special privileges assigned to logon4720 / 4726 account created / deleted4778 / 4779 session reconnect / disconnect (RDP indicator)1149 RDP user authentication succeeded (RemoteConnectionManager)4688 process creation (when command line auditing is enabled)Event logs can be cleared (Event ID 1102 records that), but clearance itself is an audit event, and shadow copies frequently retain earlier .evtx files.
NTFS is not just a file system; it is a transactional log. Every file operation touches the Master File Table ($MFT), the transaction log ($LogFile), and the change journal ($UsnJrnl:$J). Together they let us reconstruct file lifecycle events (create, rename, modify, delete) at millisecond resolution for millions of files. On top of that, Windows Explorer and the shell write user-attributable artifacts every time a user opens a folder, saves a document, or runs a program:
Recent and Office Recent record target path, target size, MAC times, and volume serial.AutomaticDestinations and CustomDestinations) show which files a user opened in each pinned application.thumbcache_*.db) preserve image previews after the images themselves are deleted.Windows tracks program execution in several parallel, mutually corroborating locations. No single artifact is authoritative on its own; taken together they answer the question “did this executable run on this machine, when, and by whom” with high confidence.
C:\Windows\Prefetch\*.pf): last eight run times, run count, and file references for the previous execution.SRUDB.dat): 30 to 60 days of process, network, and energy usage keyed by SID and executable path.Three questions dominate insider and unauthorized-access work: what plugged in, who connected remotely, and what did the user browse or search. Windows answers all three, in depth.
USBSTOR, MountedDevices, per-user MountPoints2, and setupapi.dev.log capture vendor, product, and unique serial for each device ever attached, plus per-user attribution and first-install time.Microsoft-Windows-TerminalServices-LocalSessionManager/Operational and RemoteConnectionManager/Operational (Event IDs 21, 22, 24, 25, 39, 40, 1149) show connect/disconnect and source IP; RDP bitmap cache can even reveal fragments of what was displayed.History SQLite databases; Firefox uses places.sqlite; legacy IE data lives in WebCacheV01.dat. Cache, cookies, and downloaded files corroborate the URL record.Free, confidential 20 minute consultation. We will scope the analysis, tell you what the evidence can and cannot show, and quote in writing.
Request Confidential ConsultationA timeline is the single most persuasive product of a Windows forensic exam. We combine file system metadata, event logs, registry timestamps, prefetch, browser history, and application logs into a unified chronological record. Small facts corroborate each other: a Security 4624 interactive logon at 09:14, a USBSTOR key updated at 09:15, a LNK file pointing to E:\Q3_pricing.xlsx at 09:17, an Excel jumplist entry at 09:18, a Prefetch update to EXCEL.EXE-*.pf at 09:18, and a Chrome download at 09:22 all describe the same twenty minute window with independent, tamper-resistant sources.
The single biggest mistake in a Windows matter is continuing to use the computer after an incident is suspected. Every reboot, every login, every application launch overwrites artifacts, updates timestamps, ages Prefetch entries, and may trigger scheduled cleaners. If preservation matters, isolate the device and image it under controlled conditions. Common anti-forensics techniques (registry cleaners, secure delete utilities, timestamp manipulation, hibernation file scrubbing) rarely defeat a competent examination because most of them miss the corroborating artifacts (event logs, shadow copies, application-specific logs, cloud sync caches, remote endpoint records).
| Area | Windows 10 | Windows 11 |
|---|---|---|
| Timeline / Activity History | ActivitiesCache.db populated | ActivitiesCache.db largely deprecated; SRUM, Prefetch, and Amcache remain |
| Recall / Snapshots | Not available | Windows Recall (Copilot+ PCs) can produce timestamped screenshots and OCR text where enabled |
| Default browser data | Edge (Chromium) or Chrome | Edge (Chromium), still SQLite-based |
| TPM / BitLocker | Common on business hardware | Required for setup on most consumer hardware |
| Account model | Local or Microsoft account | Microsoft account strongly preferred, more OneDrive integration |
We are independent, defense-aligned Windows forensic examiners retained by attorneys, in-house counsel, and, where appropriate, individuals and businesses directly. Every Windows matter we take begins with a scoped acquisition plan, hash-verified evidence, and a written report suitable for attorney review, negotiation, or court. When retained through counsel, our work product is protected.
Elite Digital Forensics is a nationwide, defense-aligned digital forensics practice staffed by former law enforcement forensic examiners and court-qualified experts. Our work spans criminal defense, civil litigation, family law, and corporate internal investigations. When retained through counsel, our work product is protected. All engagements begin with a free confidential consultation.
Windows forensics is the disciplined recovery, preservation, and analysis of digital evidence from Windows computers. It reconstructs what a user did, when they did it, and which files, devices, applications, and network resources were involved, using registry hives, event logs, file system metadata, prefetch, amcache, shimcache, SRUM, browser history, and dozens of related artifacts.
It can typically prove which user account was logged in at a given moment, which files were opened, created, modified, or deleted, which USB devices were connected, which programs ran, which websites were visited, and whether remote access occurred. It can also often rule out claims of unauthorized access, malware, or evidence tampering.
A focused examination of a single Windows computer typically takes two to six weeks depending on drive size, scope, and encryption. Urgent matters can be prioritized. Timelines are set in writing at engagement.
Often yes. Deleted files may remain in unallocated space, in the MFT, in shadow copies, in system restore points, or in cloud sync caches. Whether a specific file is recoverable depends on when it was deleted, how the drive has been used since, and whether TRIM has run on an SSD.
Yes, when acquisition and analysis follow accepted forensic procedures (write-blocked imaging, hash verification, documented chain of custody, reproducible tooling). Federal Rule of Evidence 702 and Daubert govern expert testimony; findings that rest on well-documented artifacts routinely survive challenge.
Both work. A forensic image (E01, AFF4, or raw dd) with matching hash values is analytically equivalent to the original for most purposes. When the physical device is available, we prefer to image it under controlled conditions.
Tell us about the computer, the accounts, and the timeframe. We will tell you what is recoverable, what is not, and what it will cost.
Request Confidential Consultation Call (833) 292-3733This content is for educational and informational purposes only and does not constitute legal advice. Elite Digital Forensics provides independent digital forensic services and expert witness testimony; we do not provide legal representation. Every case is fact-specific; outcomes depend on the evidence, jurisdiction, and counsel. Retain qualified legal counsel for advice about your matter.
Questions & Answers
What Windows artifacts prove about user activity: file access and execution history, USB and external device use, deleted file context, remote access, and how those artifacts build a defensible timeline.
Registry hives including NTUSER.DAT, ShellBags and MRU lists show folder browsing and recent file activity; LNK and Jump List entries show opened files and their original paths; Prefetch, Amcache and SRUM show program execution and resource use; the $MFT, $LogFile and USN journal record file creation, renaming, movement and deletion; event logs record logon sessions, service changes and account activity; and browser, thumbnail cache and Recycle Bin artifacts fill in the rest of the timeline.
ArtifactsConnection is usually provable: registry device enumeration, setupapi logs and event records identify the device by vendor, product and serial number and establish first and most recent connection times, often with the user account. Proving files were copied is harder and depends on corroborating artifacts — LNK files and Jump Lists referencing the removable volume, ShellBags for folders on it, and file access records — and where those are absent we say the copy is not established rather than implying it.
ArtifactsA file deleted to the Recycle Bin leaves an index record with the original path and deletion timestamp and is usually fully recoverable. A permanently deleted file has its record marked free, so content is recoverable until overwritten on a spinning disk, and often quickly unrecoverable on an SSD due to TRIM. Even after content is gone, the $MFT and USN journal frequently retain the file name, size and timestamps, which establishes that the file existed and when it was removed.
Deleted dataYes, in most cases. We examine Remote Desktop and Terminal Services event logs, network logon types and authentication records, remote-access and remote-administration software installation and session logs, firewall and VPN records, scheduled tasks and services created for persistence, and outbound connection artifacts. Correlating remote sessions against local logon activity and physical presence is often what distinguishes an intrusion from ordinary use by the account holder.
InvestigationReliable enough to build a case timeline, provided the examiner understands their mechanics. Timestamps can be affected by time zone and daylight saving handling, system clock changes, file system copy and move behavior, archive extraction, backup and synchronization tools, and deliberate timestamp manipulation. We normalize to a single reference, corroborate each critical event with at least one independent artifact source, and flag anomalies rather than presenting a timeline that quietly assumes the clock was always right.
TimelinesYes. Server and enterprise work covers Active Directory authentication and privilege changes, file server access auditing, email and mailbox activity, VPN and remote-access records, endpoint detection telemetry, and forensic acquisition of systems that cannot be taken offline. Live acquisition with volatile memory capture is used where required and documented in detail, and findings are delivered in a report suitable for litigation, insurance, internal action, or law enforcement referral.
Business casesYes. Every examiner who performs Windows forensics work at Elite Digital Forensics is a certified digital forensic examiner and a former state or federal law enforcement forensic examiner. Our examiners have been accepted as expert witnesses in state and federal courts and have qualified under Federal Rule of Evidence 702 and the Daubert standard, and the equivalent state reliability standards. The examiner who performs the work is the examiner who signs the report and testifies to it.
Experts & testimonyAcross the team our examiners hold CFCE (Certified Forensic Computer Examiner), EnCE (certified computer examiner credential), GCFE (GIAC Certified Forensic Examiner), CCME and MCFE (certified mobile device examiner credentials), ACE (certified forensic examiner credential), FBI-certified digital forensic examiner training and Computer Analysis Response Team qualification, plus CompTIA A+, Network+ and Security+, CCNA/CCNP-level networking credentials, and cloud practitioner certification — supported by continuing forensic education in mobile, computer, cloud, network and multimedia forensics.
Experts & testimonyYes. We use validated, widely peer-reviewed forensic acquisition and analysis platforms that federal and state forensic laboratories rely on, and we confirm any material finding with a second independent method. Tool names and versions, hash values, validation steps, and known tool limitations are documented in the report, and every conclusion traces back to the underlying artifact so the court is never asked to accept a software conclusion on faith.
Methodology & toolsEvidence is logged, photographed, and assigned a unique evidence number at intake, acquired using write-blocked forensically sound methods, and hash verified with MD5, SHA-1 and SHA-256 at acquisition and again before analysis. All analysis is performed on a verified working copy, never the original. Chain of custody is documented in an unbroken written record of every transfer and examination event and is produced with the report. Images and case files are stored on AES-256 class encrypted media in our access-controlled laboratory, transferred only over encrypted channels, and securely destroyed or returned at the end of the agreed retention period.
Evidence handling & securityAll three. We are retained directly by private individuals with no attorney involved, by law firms and attorneys as consulting and testifying experts under work-product protection, and by businesses for internal, insurance, and litigation matters. We accept cases nationwide, ship evidence with documented chain of custody, perform on-site collection where required, and testify in state and federal courts across the country. Consultations are free and confidential — call (833) 292-3733.
Working with usSpeak directly with a certified forensic examiner about what is on the device, what can realistically be recovered, and what a defensible examination would involve. Consultations are free and confidential.
Request a Free Consultation Call (833) 292-3733
Elite Digital Forensics Assistant
By submitting this form, you consent to be contacted by email, text, or phone. Your information is kept secure and confidential. Reply Stop to opt out at anytime.
IMPORTANT: Please remember to check your spam or junk folder