Investigating Windows Endpoints

Windows records execution, persistence, and access in dozens of artifacts the attacker rarely cleans completely. The event logs are only the surface -- the registry, prefetch, amcache, and the file-system journals corroborate or contradict them. The investigation is cross-referencing independent artifacts into one timeline that no single cleared log can defeat.

When to Use

• Triaging a compromised or suspicious Windows host, live or from an image
• Working through a KAPE, Velociraptor, or EDR triage collection
• Reconstructing what executed on a Windows machine and in what order
• Parsing EVTX / Sysmon / PowerShell logs to reconstruct attacker activity
• Hunting persistence and lateral-movement traces across the endpoint
• Detecting timestomping, log clears, and other on-host anti-forensics

When NOT to Use