Windows Forensics:
A Practical Guide to Digital Evidence

Windows systems record a great deal of their own history. Registry hives, compatibility caches, and user-profile artefacts can show what a machine was, who used it, which programs ran, and which files were opened. That record is only useful if investigators know where to look and how to interpret it.

This guide consolidates the practical Windows evidence sources that appear again and again in forensic examinations. It is a map of artefacts, not a laboratory walkthrough.

Windows forensic fundamentals

A Windows examination often starts with triage data rather than a full disk. Registry hives — SOFTWARE, SYSTEM, SAM, NTUSER.DAT, USRCLASS.DAT, and related files — survive in collections and still answer basic questions: which operating system, which name, which users, which programs. Timestamps must be read with the system's time zone in mind, or the chronology will be wrong.

System information

When only registry data is available, the operating-system version can be read from SOFTWARE\Microsoft\Windows NT\CurrentVersion. The live machine uses a volatile CurrentControlSet; SYSTEM\Select\Current identifies which control set that is, and LastKnownGood records the last known good configuration.

Computer name is under SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName — essential for confirming that the evidence belongs to the expected host. Time zone information lives under SYSTEM\CurrentControlSet\Control\TimeZoneInformation.

Network-related evidence

Network interfaces are listed under SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces. Past networks, including managed and unmanaged profiles, appear under SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures. Together they help establish where a laptop has been, not only what it did while sitting on a desk.

Registry artefacts

The SAM hive holds account, logon, and group information, largely under SAM\Domains\Account\Users. Autorun locations in NTUSER.DAT and SOFTWARE record commands and programs configured to start at logon. SYSTEM\CurrentControlSet\Services describes installed services. These keys are as relevant to persistence investigations as they are to everyday configuration review.

User activity

User hives are where individual behaviour shows up. Recent documents, typed paths, search terms, and folder views are stored per user. That is why a forensic image without user profiles is only half an examination.

Recent files

Windows Explorer keeps recently opened files in NTUSER.DAT under Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs, including extension-specific subkeys — useful when the question is the last PDF or Office document, not every file. Microsoft Office maintains its own recent lists under NTUSER.DAT\Software\Microsoft\Office\VERSION, and current Microsoft 365 identities may nest those lists under UserMRU paths that include a Live ID.

ShellBags

Folder view preferences — the Windows 'shell' — are stored as ShellBags. They can show that a folder was opened even when the folder is gone. Locations include USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags and BagMRU, with corresponding keys in NTUSER.DAT. ShellBags are about access, not necessarily about the file contents.

MRUs

Most Recently Used lists also appear in common-dialog keys: OpenSavePidlMRU and LastVisitedPidlMRU under Explorer\ComDlg32. TypedPaths and WordWheelQuery record Explorer address-bar paths and searches. Together they reconstruct how a user navigated the filesystem.

Execution evidence

UserAssist, in the NTUSER hive, records programs launched through Explorer, including launch count and time. It will not list programs started only from a command line. ShimCache (Application Compatibility Cache) in SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache tracks executables for compatibility and stores names, sizes, and last-modified times.

AmCache, typically at C:\Windows\appcompat\Programs\Amcache.hve, adds execution path, install and deletion times, and SHA1 hashes for executed programs. BAM and DAM user-settings keys under SYSTEM\CurrentControlSet\Services record last-run paths and times as part of modern standby and background-activity tracking.

Persistence indicators

Run, RunOnce, Explorer\Run policy keys, and the services list are the first persistence sweep. An unexpected binary in those locations is a lead. It still needs corroboration from execution artefacts and file-system evidence before it is called malware.

Evidence interpretation

Artefacts overlap and they lie by omission. ShimCache can record a file that was enumerated for compatibility, not necessarily launched in the way an analyst hopes. UserAssist misses CLI execution. RecentDocs can be cleared. Time zones and clock skew distort sequences. Interpretation means correlating several sources, not treating a single key as a verdict.

Investigation workflow

1. 01Confirm identity: hostname, OS version, time zone, and current control set
2. 02Establish users and accounts from SAM and profile hives
3. 03Map network context: interfaces and historical networks
4. 04Review persistence: services and logon autoruns
5. 05Rebuild user activity: recent files, ShellBags, MRUs, searches
6. 06Rebuild execution: UserAssist, ShimCache, AmCache, BAM/DAM
7. 07Correlate timestamps and document gaps rather than filling them with assumptions

Windows forensics is systematic work. The registry will not tell the whole story, but it will tell enough of it that investigators know which files, users, and time windows deserve a closer look.