Windows Forensic Artifact Reference: README

<a name="readme-top"></a>
![Windows Forensic Artifacts Guide](/media/title-2.png)
<p align="center">
  <img src="https://img.shields.io/github/license/Psmths/windows-forensic-artifacts.svg">
  <img src="https://www.repostatus.org/badges/latest/wip.svg">
  <img src="https://img.shields.io/badge/Forensic%20Artifacts-66-brightgreen">
</p>

This repository provides an in-depth guide to the various Windows forensic artifacts that can be utilized when conducting an investigation. Detailed information is provided for each artifact, including its location, available parsing tools, and instructions for interpreting the results of a forensic data extraction. Furthermore, the repository seeks to provide a comprehensive resource for those seeking to expand their understanding of Windows forensics artifacts and how to properly leverage them during a forensic investigation.

# Contents
 - [Types of Windows Artifacts](#types-of-windows-artifacts)
 - [How to Use this Guide](#how-to-use-this-guide)
 - [Artifacts by Category](#artifacts-by-category)
   * [Execution](#execution)
     - [Command Line Options](#execution---command-line-options)
     - [First Executed](#execution---first-executed)
     - [Last Executed](#execution---last-executed)
     - [Permissions/Account](#execution---permissions--account)
     - [Process Geneaology/Tree](#execution---process-tree)
     - [Execution Time](#execution---time)
     - [Evidence of Execution](#execution---evidence-of-execution)
   * [Account Activity](#account-activity)
     - [Account Creation Time](#account---creation-time)
     - [Group Membership](#account---group-membership)
     - [Last Login](#account---last-login)
     - [Login History](#account---login-history)
     - [Logon ID](#account---logon-id)
     - [Relative Identifier (RID)](#account---relative-identifier-rid)
     - [Security Identifier (SID)](#account---security-identifier-sid)
     - [Username](#account---username)
   * [File Activity](#file-activity)
     - [Creation](#file---creation)
     - [Deletion](#file---deletion)
     - [Hash](#file---hash)
     - [Last Modified](#file---last-modified)
     - [Origin](#file---origin)
     - [Path](#file---path)
     - [Size](#file---size)
   * [Network Activity](#network-activity)
     - [Evidence of Network Activity](#network-activity---evidence-of-network-activity)
     - [Destination Identification](#network-activity---destination-identification)
     - [Source Identification](#network-activity---source-identification)
     - [Transmit Volume](#network-activity---transmit-volume)
     - [Browser Activity](#network-activity---browser-activity)
     - [Firewall Activity](#network-activity---firewall-activity)
     - [Wireless Activity](#network-activity---wireless-activity)
   * [Browser Activity](#browser-activity)
     - [History](#browser-activity---history)
     - [Bookmarks](#browser-activity---bookmarks)
   * [User Activity](#user-activity)
   * [Group Policy Activity](#group-policy-activity)
 - [System Enumeration Artifacts](#enumeration-artifacts)
 - [Artifact Behavioral Mappings](#artifact-behavioral-mappings) 
   * [TA0002 - Execution](#ta0002-execution)
   * [TA0003 - Persistence](#ta0003-persistence)
   * [TA0008 - Lateral Movement](#ta0008-lateral-movement)

<p align="right">(<a href="#readme-top">back to top</a>)</p>

# Types of Windows Artifacts
Forensic artifacts on the Windows operatying system can generally be split into four main categories:

 1. Registry 
 2. Filesystem
 3. Event Log
 4. Memory

**Registry** artifacts are found in the Windows registry, which is loaded into memory while a system is in operation and written to disk during shutdown. The registry stores low-level configuration settings for the operating system and contains a wealth of forensic artifacts of interest to an analyst.

**Filesystem** artifacts are artifacts that arise due to the operation of Windows' filesystem - NTFS (New Technology File System).

**Event log** artifacts are found in the Windows event log and consist primarily of audit logs from the operating system and its applications. 

**Memory** artifacts are those artifacts found in the endpoint's memory while it is operational. These artifacts must be collected from a live system, and are generally not applicable to dead disk forensics with certain exceptions such as page files and hibernation files that consist of memory that has been written to the disk. 

A complete forensic analysis of a Windows endpoint will consist of one or all of these artifacts. They may be collected and parsed individually at the analyst's discretion, or consolidated into "super timelines" with forensic software such as [log2timeline](https://github.com/log2timeline).

<p align="right">(<a href="#readme-top">back to top</a>)</p>

# How to Use this Guide

This guide was created to classify the numerous Windows forensic artifacts and provide a concise list of what information they respectively provide. While it may be used as a general reference, it shines when it comes time to tie separate artifacts together based on mutual/shared datapoints.

For instance, if it is known that an attacker has logged into an endpoint around a certain time, an analyst may want to determine what activity on the endpoint can be attributed to this session. For this, the analyst might begin by looking at 4624 Login events and pull the `Logon ID` from this artifact. This guide provides a list of every artifact that has the `Logon ID` field present, providing a quick way to correlate logon activity with other activity on the endpoint filed under the section [Logon ID](#account---logon-id).

As another example, say for instance you are aware that an endpoint may have a malicious file on it. Maybe you want to see [when the file was created](#file---creation), or [when it was first executed](#execution---first-executed). What about determining [what Logon ID is associated with the execution with 4688 events?](#account---logon-id)

Building a visual map in your mind of the relationships between all the artifacts present in Windows is necessary to allow for an analyst to efficiently pivot their focus during an investigation, this guide simply lays it all out and provides useful analysis tips collected during years of forensic experience while doing so.

<p align="right">(<a href="#readme-top">back to top</a>)</p>

# Artifacts by Category

The forensic artifacts described in this repository are split into the following categories:

 - [Execution](#execution)
 - [Account Activity](#account-activity)
 - [File Activity](#file-activity)
 - [Network Activity](#network-activity)

## Execution
Execution artifacts may provide the following information:

### Execution - Command Line Options
>What command line was used to spawn this process?

 - [Security/4688: A new process has been created](execution/evtx-4688-process-created.md)
 - [Scheduled Task Files](persistence/task-scheduler-files.md)
 - [TaskScheduler/Operational Log](persistence