deardaniel/secdata-raw huggingface dataset:
Forensic Artifact Definitions Database: README

## Digital Forensics Artifacts Repository

A free, community-sourced, machine-readable knowledge base of digital forensic
artifacts that the world can use both as an information source and within other
tools.

If you'd like to use the artifacts in your own tools, **all you need to be able
to do is read YAML**. That is it, no other dependencies. The Python code in
this project is just used to validate all the artifacts to make sure they
follow the specification.

For more information see:

* Project documentation: https://artifacts.readthedocs.io/en/latest

## Contributing

Please send us your contribution! See [the developers guide](https://github.com/ForensicArtifacts/artifacts/wiki/Developers-guide) for instructions.

## Contact

* [forensicartifacts@googlegroups.com](https://groups.google.com/forum/#!forum/forensicartifacts)
* Artifacts channel of [Open Source DFIR Slack](https://github.com/open-source-dfir/slack)
Forensic Artifact Definitions Database: index

Welcome to the Forensics Artifacts documentation
================================================

Digital Forensics Artifacts Repository, is a free, community-sourced,
machine-readable knowledge base of digital forensic artifacts that the world
can use both as an information source and within other tools.

The source code is available from the `project page <https://github.com/ForensicArtifacts/artifacts>`__.

.. toctree::
   :maxdepth: 2

   sources/user/index
   sources/background/index
   Format specification <sources/Format-specification>
   API documentation <sources/api/artifacts>


Indices and tables
==================

* :ref:`genindex`
* :ref:`modindex`
Forensic Artifact Definitions Database: artifacts

artifacts package
=================

Subpackages
-----------

.. toctree::
   :maxdepth: 4

   artifacts.scripts

Submodules
----------

artifacts.artifact module
-------------------------

.. automodule:: artifacts.artifact
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.definitions module
----------------------------

.. automodule:: artifacts.definitions
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.errors module
-----------------------

.. automodule:: artifacts.errors
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.reader module
-----------------------

.. automodule:: artifacts.reader
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.registry module
-------------------------

.. automodule:: artifacts.registry
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.source\_type module
-----------------------------

.. automodule:: artifacts.source_type
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.writer module
-----------------------

.. automodule:: artifacts.writer
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: artifacts
   :members:
   :show-inheritance:
   :undoc-members:
Forensic Artifact Definitions Database: artifacts.scripts

artifacts.scripts package
=========================

Submodules
----------

artifacts.scripts.stats module
------------------------------

.. automodule:: artifacts.scripts.stats
   :members:
   :show-inheritance:
   :undoc-members:

artifacts.scripts.validator module
----------------------------------

.. automodule:: artifacts.scripts.validator
   :members:
   :show-inheritance:
   :undoc-members:

Module contents
---------------

.. automodule:: artifacts.scripts
   :members:
   :show-inheritance:
   :undoc-members:
Forensic Artifact Definitions Database: index

##########
Background
##########

The first version of the artifact definitions originated from the
`GRR project <https://github.com/google/grr>`__, where it is used to describe
and quickly collect data of interest, for example specific files or Windows
Registry keys. The goal of the format is to provide a tool independent way to
describe the majority of forensic artifacts in a language that is readable by
humans and machines.

The format is designed to be simple and straight forward, so that a digital
forensic analysist is able to quickly write artifact definitions during an
investigation without having to rely on complex standards or tooling.

The format is intended to describe forensically-relevant data on a machine,
while being tool agnostic. In particular we intentionally avoided adding
IOC-like logic, or describing how the data should be collected since this
various between tools.

For some background on the artifacts system and how we expect it to be used see
`this Blackhat presentation <https://blackhat.com/docs/us-14/materials/us-14-Castle-GRR-Find-All-The-Badness-Collect-All-The-Things.pdf>`__
and `YouTube video <https://www.youtube.com/watch?v=ren6QSvwFvg>`__ from the GRR team.

.. toctree::
   :maxdepth: 2

   Terminology <Terminology>
   Statistics <Stats>
Forensic Artifact Definitions Database: Stats

## Statistics

The artifact definitions can be found in the
[artifacts/data directory](https://github.com/ForensicArtifacts/artifacts/tree/main/artifacts/data) and the format is described
in detail in the [Style Guide](https://artifacts.readthedocs.io/en/latest/sources/Format-specification.html).

Status of the repository as of 2026-05-01

Description | Number
--- | ---
Number of artifact definitions: | 837
Number of file paths: | 2339
Number of Windows Registry key paths: | 677

### Artifact definition source types

Identifier | Number
--- | ---
ARTIFACT_GROUP | 48
COMMAND | 10
FILE | 551
PATH | 28
REGISTRY_KEY | 57
REGISTRY_VALUE | 116
WMI | 27

### Operating systems

Identifier | Number
--- | ---
Darwin | 215
ESXi | 16
Linux | 249
Windows | 385
Forensic Artifact Definitions Database: Terminology

# Terminology

The term artifact (or artefact) is widely used within computer (or digital)
forensics, though there is no official definition of this term.

The definition closest to the meaning of the word within computer forensics is
that of the word artifact within
[archaeology](https://en.wikipedia.org/wiki/Artifact_(archaeology)). The term
should not be confused with the word artifact used within
[software development](https://en.wikipedia.org/wiki/Artifact_(software_development)).

If archaeology defines an artifact as:

```
something made or given shape by man, such as a tool or
a work of art, esp an object of archaeological interest
```

The definition of artifact within computer forensics could be:

```
An object of digital archaeological interest.
```

Where digital archaeology roughly refers to computer forensics without the
forensic (legal) context.
Forensic Artifact Definitions Database: Installation instructions

# Installation instructions

## pip

**Note that using pip outside virtualenv is not recommended since it ignores
your systems package manager. If you aren't comfortable debugging package
installation issues, this is not the option for you.**

Create and activate a virtualenv:

```bash
virtualenv artifactsenv
cd artifactsenv
source ./bin/activate
```

Upgrade pip and install Forensics Artifacts dependencies:

```bash
pip install --upgrade pip
pip install artifacts
```

To deactivate the virtualenv run:

```bash
deactivate
```

## Ubuntu 22.04 LTS

To install Forensics Artifacts from the [GIFT Personal Package Archive (PPA)](https://launchpad.net/~gift):

```bash
sudo add-apt-repository ppa:gift/stable
```

Update and install Forensics Artifacts:

```bash
sudo apt-get update
sudo apt-get install python3-artifacts
```

## Windows

The [l2tbinaries](https://github.com/log2timeline/l2tbinaries) contains the
necessary packages for running Forensics Artifacts. l2tbinaries provides the following
branches:

* main; branch intended for the "packaged release" of Forensics Artifacts and dependencies;
* staging; branch intended for testing pre-releases of Forensics Artifacts;
* dev; branch intended for the "development release" of Forensics Artifacts;
* testing; branch intended for testing newly created packages.

The l2tdevtools project provides [an update script](https://github.com/log2timeline/l2tdevtools/wiki/Update-script)
to ease the process of keeping the dependencies up to date.

The script requires [pywin32](https://github.com/mhammond/pywin32/releases).

To install the release versions of the dependencies run:

```
set PYTHONPATH=.

C:\Python38\python.exe tools\update.py --preset artifacts
```
Forensic Artifact Definitions Database: index

###############
Getting started
###############

To be able to use Forensics Artifacts you first need to install it. There are
multiple ways to install Forensics Artifacts, check the following instructions
for more detail.

.. toctree::
   :maxdepth: 2

   Installation instructions <Installation-instructions>
Windows Registry Knowledge Base: README

winreg-kb is a project to build a Windows Registry Knowledge Base.

winregrc is a Python module part of winreg-kb to allow reuse of Windows
Registry Resources.

For more information see:
* Project documentation: https://winreg-kb.readthedocs.io/en/latest
Windows Registry Knowledge Base: index

Welcome to the winreg-kb documentation
========================================

winreg-kb is a project to build a Windows Registry Knowledge Base.

winregrc is a Python module part of winreg-kb to allow reuse of Windows
Registry Resources.

The source code is available from the `project page <https://github.com/libyal/winreg-kb>`__.

.. toctree::
   :maxdepth: 2

   sources/windows-registry/index

.. toctree::
   :maxdepth: 2

   sources/system-keys/index

.. toctree::
   :maxdepth: 2

   sources/security-accounts-manager-keys/index

.. toctree::
   :maxdepth: 2

   sources/explorer-keys/index

.. toctree::
   :maxdepth: 2

   Windows EventLog keys <sources/EventLog-keys>

.. toctree::
   :maxdepth: 2

   sources/internet-explorer-keys/index

.. toctree::
   :maxdepth: 2

   sources/application-keys/index

.. toctree::
   :maxdepth: 2

   API documentation <sources/api/winregrc>


Indices and tables
==================

* :ref:`genindex`
* :ref:`modindex`
Windows Registry Knowledge Base: index

##############################
Security accounts manager keys
##############################

.. toctree::
   :maxdepth: 1

   Security accounts manager <Security-accounts-manager>
   Domains <Domains>
Windows Registry Knowledge Base: Security accounts manager

# Security Accounts Manager (SAM)

The Security Accounts Manager (SAM) is stored in the key:

```
HKEY_LOCAL_MACHINE\SAM\SAM
```

Sub keys:

Name | Description
--- | ---
Domains | Built-in and account domains
RXACT |

Values:

Name | Data type | Description
--- | --- | ---
C | REG_BINARY |

### C value data

The C value data is variable of size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 2 | | <mark style="background-color: yellow">**Unknown (Format version?)**</mark>
2 | 2 | | <mark style="background-color: yellow">**Unknown**</mark>
4 | 4 | | <mark style="background-color: yellow">**Unknown (empty?)**</mark>
8 | 4 | | Security descriptor data size
12 | 2 | | <mark style="background-color: yellow">**Unknown**</mark>
14 | 2 | | <mark style="background-color: yellow">**Unknown**</mark>
16 | ... | | Security descriptor data

#### Format version

Value | Description
--- | ---
1 | Used in Windows NT 3.1
2 | Used in Windows NT 3.5
3 | Used in Windows NT 4
6 | Used in Windows 2000
7 | Used in Windows XP and later
9 | Used in Windows Windows 11
Windows Registry Knowledge Base: index

################
Application keys
################

.. toctree::
   :maxdepth: 1

   7-Zip <7-Zip>
   CCleaner <CCleaner>
   Microsoft Office <Microsoft-Office>
   Terminal server client <Terminal-server-client>
   WinRAR <WinRAR>
Windows Registry Knowledge Base: MSDN web browser

# MSDN web browser

**TODO this page currently contains rough notes, fine tune these**

```
HKEY_CURRENT_USER\Software\Microsoft\MSDN\9.0\WebBrowser\MRU
```

Values:

Name | Data type | Description
--- | --- | ---
%NUMERIC% | REG_SZ | Where %NUMERIC% is a string in the form: "[0-9]+"
Windows Registry Knowledge Base: 7 Zip

# 7-Zip

**TODO this page currently contains rough notes, fine tune these**

The 7-Zip application uses the following Windows Registry key to store various
user specific information.

```
HKEY_CURRENT_USER\Software\7-Zip
```

Sub keys:

Name | Description
--- | ---
FM |

Values:

Name | Data type | Description
--- | --- | ---
Lang | | Language tag, for example "en-US" or "-" if empty.

## 7-Zip FM sub key

Sub keys:

Name | Description
--- | ---
Columns |

Values:

Name | Data type | Description
--- | --- | ---
FlatViewArc# | | Where # is a numeric value e.g. 0 or 1
FolderShortcuts | |
FolderHistory | | Contains a list of UTF-16 little-endian encoded strings with an end-of-string character
ListMode | |
Panels | |
PanelPath# | | Where # is a numeric value e.g. 0 or 1 <br> Contains an UTF-16 little-endian encoded string
Position | |

### 7-Zip FM Columns sub key

Values:

Name | Data type | Description
--- | --- | ---
7-Zip.Rar | REG_BINARY |
7-Zip.7z | REG_BINARY |
Windows Registry Knowledge Base: WinRAR

# WinRAR

**TODO this page currently contains rough notes, fine tune these**

The WinRAR application uses the following Windows Registry key to store various
user specific information.

```
HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ArcName
HKEY_CURRENT_USER\Software\WinRAR\DialogEditHistory\ExtrPath
```

Values:

Name | Data type | Description
--- | --- | ---
%ITEM% | REG_SZ | Where %ITEM% is a string in the form: "[0-9]+"
Windows Registry Knowledge Base: Terminal server client

# Terminal server client

The most recent used (MRU) connnections of the Terminal server client can
be found in the key:

```
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default
```

Values:

Name | Data type | Description
--- | --- | ---
MRU# | REG_SZ | The most recently used connection. <br> Where # is a string in the form: "[0-9]+"

The contents of MRU# is either an IP address, e.g. 192.168.16.60, or a hostname, e.g. computer.domain.com.

## External Links

* [How to Remove Entries from the Remote Desktop Connection Computer Box](https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer)
Windows Registry Knowledge Base: index

################
Windows Registry
################

.. toctree::
   :maxdepth: 1

   Hives <Hives>
   Files <Files>
   Multilingual User Interface (MUI) form <MUI-form>
Windows Registry Knowledge Base: MUI form

# Multilingual User Interface (MUI) form

The Multilingual User Interface (MUI) form is used to store strings in multiple
languages. This is also known as Registry string redirection.

The actual strings are stored in the resource sections of PE/COFF files (also
referred to as resource file) e.g .exe, .dll.

In the Registry the MUI strings are referenced using the following form:

```
@path,-stringID[;comment]
```

Where:

* path; is the full path or filename of the resource file that contains the
string
* stringID; the identifier of the string within the string resource of the
resource file
* comment; a comment

For example the MUI form string:

```
@%SystemRoot%\system32\SHELL32.dll,-9227
```

This MUI form string refers to the string with identifier 9227, stored in the
string resource of SHELL32.dll. Which, for an English version of SHELL32.dll,
corresponds to: "My Documents".

An example of a MUI form with comment:

```
@wfplwfs.inf,%WfpLwfs_Name%;WFP LightWeight Filters
```

## Notes

What about the form (seen in the Shell Folder value LocalizedString):

```
@%SystemRoot%\System32\fvecpl.dll,-1#immutable1
```

What does # represent here?

```
@wd.inf,%WdServiceDisplayName%;Microsoft Watchdog Timer Driver
```

Yet another variation seen in Windows 2000.

```
@C:\WINNT\system32\shell32.dll,-9227@1033,My Documents
```

## External Links

* [Multilingual User Interface](https://learn.microsoft.com/en-us/windows/win32/intl/multilingual-user-interface)
* [Using Registry String Redirection](https://learn.microsoft.com/en-us/windows/win32/intl/using-registry-string-redirection)
Windows Registry Knowledge Base: Hives

# Windows Registry hives

Name | Short name | Description
--- | --- | ---
HKEY_CLASSES_ROOT | HKCR | Used by Windows 3.1, 9x/Me and NT 4 and later <br> Refers to values in both HKEY_CURRENT_USER\\Software\\Classes and HKEY_LOCAL_MACHINE\\Software\\Classes
HKEY_CURRENT_CONFIG | HKCC | Used by Windows 9x/Me and NT 4 and later <br> Refers to the current control set in HKLM
HKEY_CURRENT_USER | HKCU | Information regarding the current active user <br> Used by Windows 9x/Me and NT 4 and later <br> Refers to the active user key in HKEY_USERS
HKEY_DYN_DATA | | Dynamic data <br> Used by Windows 9x/Me
HKEY_LOCAL_MACHINE | HKLM | Local settings <br>Used by Windows 9x/Me and NT 4 and later
HKEY_PERFORMANCE_DATA | | Performance data <br> Used by Windows NT 4 and later
HKEY_USERS | HKU | Information about all active users <br> Used by Windows 9x/Me and NT 4 and later
Windows Registry Knowledge Base: Environment variables

# Environment variables

The environment variables are stored in multiple keys.

## Session Manager\\Environment key

```
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Environment
```

Values:

Name | Data type | Description
--- | --- | ---
%NAME% | REG_SZ | Value of an environment variable, where %NAME% contains the name of the environment variable.

For example the "windir" value that contains "%SystemRoot%".

## Windows\\CurrentVersion key

Values of environment variables such as %%ProgramFiles% can be derived from
values in the Windows\\CurrentVersion key:

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
```

Values:

Name | Data type | Description
--- | --- | ---
CommonFilesDir | REG_SZ | Value of %CommonProgramFiles% environment variable
CommonFilesDir (x86) | REG_SZ | Value of %CommonProgramFiles(x86)% environment variable
CommonW6432Dir | REG_SZ | Value of %CommonProgramW6432% environment variable
ProgramFilesDir | REG_SZ | Value of %ProgramFiles% environment variable
ProgramFilesDir (x86) | REG_SZ | Value of %ProgramFiles(x86)% environment variable
ProgramW6432Dir | REG_SZ | Value of %ProgramW6432% environment variable

For example the "ProgramFilesDir (x86)" value that contains
"C:\Program Files (x86)".

## Windows NT\\CurrentVersion key

The %SystemRoot% environment variable can be derived from values in
the Windows NT\\CurrentVersion key:

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
```

Values:

Name | Data type | Description
--- | --- | ---
SystemRoot | REG_SZ | Value of %SystemRoot% environment variable

For example the "SystemRoot" value that contains "C:\\Windows"

## CurrentVersion\\ProfileList key

Values of environment variables such as %ProgramData% can be derived from
values in the CurrentVersion\\ProfileList key:

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList
```

Values:

Name | Data type | Description
--- | --- | ---
AllUsersProfile | REG_SZ | Value of the %AllUsersProfile% environment variable (Seen on Windows XP)
Default | REG_SZ | (Seen on Windows Vista)
DefaultUserProfile | REG_SZ | (Seen on Windows XP)
ProfilesDirectory | REG_EXPAND_SZ | Profiles directory, for example "C:\Documents and Settings" on Windows XP or "C:\Users" on Windows Vista.
ProgramData | REG_SZ | Value of the %ProgramData% environment variable (Seen on Windows Vista)
Public | REG_SZ | Value of the %Public% environment variable

If the AllUsersProfile value does not start with an environment variable or
an absolute path, but a relative path, it is currently assumed that the value
should be prefixed with the value in ProfilesDirectory.

## User specific environment variables

```
HKEY_CURRENT_USER\Environment
```

Values:

Name | Data type | Description
--- | --- | ---
%NAME% | REG_SZ | Value of an user specific environment variable, where %NAME% contains the name of the environment variable.
Windows Registry Knowledge Base: index

###################
Windows system keys
###################

.. toctree::
   :maxdepth: 1

   Application compatibility cache <Application-compatibility-cache>
   Background activity moderator <Background-activity-moderator>
   Boot verification <Boot-verification>
   Cached credentials <Cached-credentials>
   Certificates <Certificates>
   Codepage <Codepage>
   COM class identifiers <COM-class-identifiers>
   Current control set <Current-control-set>
   Environment variables <Environment-variables>
   File system <File-system>
   Language <Language>
   Local security authority <Local-security-authority>
   Mounted devices <Mounted-devices>
   Prefetch <Prefetch>
   Run and RunOnce <Run-and-RunOnce>
   Services and drivers <Services-and-drivers>
   Session manager <Session-manager>
   Shell folder identifiers <Shell-folder-identifiers>
   System restore <System-restore>
   Task scheduler <Task-scheduler>
   Time zones <Time-zones>
   USB storage <USB-storage>
   Volume shadow copies <Volume-shadow-copies>
   Windows error reporting <Windows-error-reporting>
   Windows product information <Windows-product-information>
   Windows system locations <Windows-system-locations>
Windows Registry Knowledge Base: Windows system locations

# Windows system locations

Windows system locations can be found in the key:

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
```

Values:

Name | Data type | Description
--- | --- | ---
CommonFilesDir | REG_SZ | path of the common program files directory, also set in the %CommomProgramFiles% environment variable
CommonFilesDir (x86) | REG_SZ | path of the 32-bit common program directory folder on a 64-bit Windows installation, also set in the %CommomProgramFiles(x86)% environment variable
DevicePath | REG_SZ |
MediaPath | REG_SZ |
MediaPathUnexpanded | REG_SZ |
PF_AccessoriesName | |
ProductId | |
ProgramFilesDir | REG_SZ | path of the "Program Files" directory, also set in the %ProgramFiles% environment variable
ProgramFilesDir (x86) | REG_SZ | path of the 32-bit "Program Files" directory on a 64-bit Windows installation, also set in the %ProgramFiles(x86)% environment variable
SM_AccessoriesName | |
SM_ConfigureProgramsExisted | |
SM_ConfigureProgramsName | |
SM_GamesName | |
WallPaperDir | REG_SZ |
Windows Registry Knowledge Base: Codepage

# Codepage

The codepage settings are stored in the key:

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\CodePage
```

Values:

Name | Data type | Description
--- | --- | ---
`#` | REG_SZ | The name of the code page National Language Support file (.nls) <br/> Where # is the code page number, e.g. 1252 <br/> Contains a string with the name of the corresponding file e.g. c_1252.nls
ACP | REG_SZ | The default ANSI (extended ASCII) code page <br/> Contains a string with the number of the corresponding code page e.g. 1252
MACCP | REG_SZ | The default Macintosh code page <br/> Contains a string with the number of the corresponding code page e.g. 1252
OEMCP | REG_SZ | The default OEM code page <br/> Contains a string with the number of the corresponding code page e.g. 1252
OEMHAL | REG_SZ | <mark style="background-color: yellow">**Unknown**</mark> <br/> Contains a string with the name of the corresponding file e.g. vgaoem.fon