Windows Artifacts

Scope

What this is: Analysing Windows Registry, Prefetch, UserAssist, and other forensic artefacts.

Competition relevance: Digital forensics and incident response, from national stage up. Deep Windows knowledge for timeline reconstruction.

Why it matters: Artefacts reveal program execution, user activity, and persistence mechanisms.

WSOS 2026 alignment: This topic directly supports Section 8: Investigation and digital forensics (examining Windows-specific artefacts for evidence of program execution and user activity).

Competition area: Core to the digital forensics and incident response area, where you analyse Windows systems for evidence of malware execution, persistence mechanisms, and user activity through Registry, Prefetch, and other artefacts.

Offline competence: RegRipper, Eric Zimmerman’s tools (RECmd, PECmd, JLECmd, LECmd, AmcacheParser) all work offline. Use built-in Windows reg command for live analysis. Reference Eric Zimmerman’s tool documentation (download offline) for artefact interpretation.

---

Competency Matrix

Level	Expectation
Regional	Not typically required. Focus on file-based evidence.
National	Registry analysis for Run keys, UserAssist, ShimCache. Prefetch analysis.
Squad/Team Selection	Jump lists, LNK files, SRUM, AmCache. Correlation across artifacts.
International	VSS analysis. Advanced Registry forensics. Custom artifact parsing.

---

Technical Content

Registry Analysis

Key locations:

Autorun/Persistence:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\Run

UserAssist (program execution):

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
# Stores ROT13-encoded program names with execution count and last run time

ShimCache (AppCompatCache):

HKLM\System\CurrentControlSet\Control\Session Manager\AppCompatCache
# Tracks executed programs (path, size, modification time)

MRU Lists (Most Recently Used):

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU

Analyzing Registry:

# RegRipper (parse offline Registry hives)
rip.pl -r SOFTWARE -p userassist

# Eric Zimmerman's tools
RECmd.exe -d C:\Windows\System32\config --bn BatchExample

# Export from live system
reg export HKLM\Software\Microsoft\Windows\CurrentVersion\Run run_keys.reg

---

Prefetch Analysis

Location: C:\Windows\Prefetch\

What it reveals:

• Program execution (filename)
• Last 8 execution times (Windows 10+)
• Files/directories accessed by program

Analyzing Prefetch:

# Eric Zimmerman's PECmd
PECmd.exe -f "C:\Windows\Prefetch\MALWARE.EXE-12345678.pf"

# View execution times, loaded DLLs, accessed volumes

Competition context: Prefetch proves program execution even if binary is deleted.

---

Jump Lists

Location: C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\

What it reveals: Recently accessed files per application

Analyzing:

# JLECmd (Eric Zimmerman)
JLECmd.exe -d "C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" --csv output

---

LNK Files (Shortcuts)

Location: C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Recent\

Metadata:

• Target file path
• MAC times
• Volume serial number
• Machine name

Analyzing:

# LECmd (Eric Zimmerman)
LECmd.exe -f "file.lnk"

---

AmCache

Location: C:\Windows\AppCompat\Programs\Amcache.hve

What it reveals: Program execution, SHA1 hashes, first execution time

Analyzing:

# AmcacheParser (Eric Zimmerman)
AmcacheParser.exe -f Amcache.hve --csv output

---

Competition Strategy & Marking

What gets marked:

• Malware execution timeline (Prefetch, UserAssist, AmCache)
• Persistence mechanisms identified (Registry Run keys)
• User activity reconstructed (MRU lists, Jump Lists)

Evidence and reporting requirements:

• Registry export showing persistence keys with full path and values
• Prefetch analysis output showing execution times (all 8 timestamps for Windows 10+)
• Timeline correlation spreadsheet showing events from multiple artefact types
• UserAssist decoded entries with execution counts and last run times
• Screenshots of Eric Zimmerman tool output (PECmd, RECmd, AmcacheParser)
• Written analysis explaining significance of findings (e.g., “malware.exe executed 3 times between 10:00-10:15”)
• Hash values for identified malware from AmCache
• Clear naming: registry_run_keys_malware_persistence.txt, prefetch_malware_execution_timeline.png

Time allocation:

• Registry analysis: 20 minutes
• Prefetch/AmCache: 15 minutes
• Correlation: 10 minutes

Time-boxed drill suggestion: 45-minute Windows artefacts analysis sprint: Given a compromised Windows system image, extract and analyse Registry Run keys for persistence, parse all Prefetch files for program execution timeline, decode UserAssist for user activity, analyse AmCache for SHA1 hashes of executed programs, parse Jump Lists and LNK files for recently accessed files, and correlate all artefacts into a comprehensive timeline showing malware installation, execution, and persistence.

---

False Flags / Wrong Paths

Common Traps

Timezone issues Registry timestamps may be in different formats. Normalize to UTC.

Partial artifacts Prefetch may be disabled or cleared. Don’t rely on single artifact type.

Anti-forensics Attackers may clear artifacts. Look for absences (e.g., missing Prefetch for critical period).

---

Practice Checklist

• Can extract and analyse Registry hives
• Can decode UserAssist entries
• Can parse Prefetch files for execution times
• Can analyse Jump Lists and LNK files
• Can correlate artifacts into timeline
• Can identify persistence via Registry Run keys

---

References

• National Roadmap: Digital forensics
• Tools: Eric Zimmerman’s Tools