Windows forensic artefacts and building a timeline
In short: Windows records a great deal of activity as a side effect of normal use: event logs, registry keys, prefetch files, browser databases and file system journals. Investigators parse these artefacts and merge them into a single timeline to show who ran what, which files were touched and when.
Why Windows artefacts matter
An artefact is any trace that the operating system or an application leaves behind. Windows was not designed for forensics, but to make features work it records which programs ran, which files were opened and which devices were connected. Investigators use these traces to answer questions such as "Did the user run this file?" or "When did the attacker first log on?"
Event logs
Windows event logs are stored as .evtx files in C:\Windows\System32\winevt\Logs. A few event IDs come up again and again:
| Log and ID | Meaning |
|---|---|
| Security 4624 / 4625 | Successful / failed logon (check the logon type, for example 3 network, 10 remote desktop) |
| Security 4688 | New process created (command line only if auditing is configured) |
| Security 4720 | User account created |
| Security 4698 | Scheduled task created |
| Security 1102 | Security audit log cleared |
| System 7045 | New service installed |
Sysmon, a free Microsoft tool, adds richer process, network and file events if installed beforehand. On a collected copy of the logs, PowerShell can query an exported file:
Get-WinEvent -Path .\Security.evtx -FilterXPath "*[System[(EventID=4624 or EventID=4625)]]" |
Select-Object TimeCreated, Id, Message | Export-Csv logons.csv -NoTypeInformationRegistry, execution and file artefacts
- Registry hives: SYSTEM, SOFTWARE, SAM and SECURITY in
C:\Windows\System32\config, plus each user’sNTUSER.DATandUsrClass.dat. They hold installed software, USB device history, network profiles, autoruns (Run keys and services), UserAssist program counts and ShellBags showing folders a user browsed. - Prefetch:
.pffiles inC:\Windows\Prefetchrecord programs that ran, a run count and recent run times. Prefetch may be disabled on some servers. - Amcache.hve and Shimcache: record executables seen by the system, often with file hashes; treat them as evidence the file existed, and confirm execution with other artefacts.
- NTFS metadata: the
$MFTholds file timestamps and the$UsnJrnljournal records file creation, renames and deletions. - LNK files and jump lists: show files and folders a user opened, even from USB drives that are gone.
- Browser history: Chrome and Edge keep SQLite databases under the user’s
AppData\Localprofile folder, with visits and downloads. Firefox usesplaces.sqlite. - SRUM (System Resource Usage Monitor): roughly hourly records of application and network use.
Free parsers such as Eric Zimmerman’s tools (for example EvtxECmd, PECmd, MFTECmd and Registry Explorer) and KAPE for collection are widely used in training and real cases.
Building and reading a timeline
A super timeline combines events from all artefacts into one sorted list. Plaso (the log2timeline tool) can do this automatically from a disk image; you can then filter and review the result in a spreadsheet-style viewer such as Timeline Explorer.
log2timeline.py --storage-file case.plaso exh004.E01
psort.py -o l2tcsv -w timeline.csv case.plaso "date > '2026-03-14 08:00:00' AND date < '2026-03-14 12:00:00'"Work outwards from a known anchor, such as the time of an alert. Look for the chain: a logon (4624), a file downloaded in browser history, the file appearing in the MFT, prefetch showing it ran, then a new service (7045) for persistence. Watch for traps: some timestamps are local time and others UTC, attackers can change file timestamps (timestomping), and a missing log may mean it was cleared, so check for event 1102.
Tip: practise on a lab Windows virtual machine: run a harmless program, browse a site, then find each action in the artefacts and place it on your own timeline.
Practice
Which Windows event ID shows that the Security log was cleared, and why does it matter?
Why should Amcache or Shimcache entries be confirmed with other artefacts?
What is a super timeline?
Key takeaways
- Windows records activity in event logs, the registry, prefetch, Amcache and file system journals.
- Learn the key event IDs: 4624, 4625, 4688, 4720, 4698, 1102 and 7045.
- Confirm program execution with more than one artefact.
- Merge artefacts into a UTC super timeline and work out from a known anchor.
- Watch for time zone mix-ups, timestomping and cleared logs.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.