#windowsforensics — Public Fediverse posts

FortiGuard IR researchers have highlighted unexpected forensic value in the AutoLogger-Diagtrack-Listener.etl file on modern Windows systems.

Despite low exploitation severity, the artefact has shown the ability to preserve historical process-execution data, including deleted binaries and command-line traces — helpful in ransomware investigations.

What’s your view on ETW-based artefacts in DFIR workflows?

Source: https://www.fortinet.com/blog/threat-research/uncovering-hidden-forensic-evidence-in-windows-mystery-of-autologger

Share your insights and follow us for more clear, unbiased analysis.

#InfoSec #DFIR #ThreatIntel #WindowsForensics #ETW #Telemetry #CyberSecurity #IncidentResponse #SecurityResearch #ThreatAnalysis

Deleted a folder? Shellbags is the accessory you need...

They’re one of the most valuable forensic artifacts for tracing user activity in Windows, even if the folders are gone.

This blog post by our Joseph Williams walks through how Shellbags work, how to analyse them with tools like ShellBags Explorer, and what they reveal about user navigation through local, external, and network locations.

If you're in DFIR, this is one artifact you don't want to miss.

📌 Read the blog: https://www.pentestpartners.com/security-blog/dfir-tools-and-techniques-for-tracing-user-footprints-through-shellbags/

#DFIR #DigitalForensics #WindowsForensics #IncidentResponse #Shellbags #CyberSecurity #ForensicAnalysis

Deleted a folder? Shellbags is the accessory you need...

They’re one of the most valuable forensic artifacts for tracing user activity in Windows, even if the folders are gone.

This blog post by our Joseph Williams walks through how Shellbags work, how to analyse them with tools like ShellBags Explorer, and what they reveal about user navigation through local, external, and network locations.

If you're in DFIR, this is one artifact you don't want to miss.

📌 Read the blog: https://www.pentestpartners.com/security-blog/dfir-tools-and-techniques-for-tracing-user-footprints-through-shellbags/

#DFIR #DigitalForensics #WindowsForensics #IncidentResponse #Shellbags #CyberSecurity #ForensicAnalysis

Handbook of windows forensic artifacts across multiple Windows version with interpretation tips with some examples: https://github.com/Psmths/windows-forensic-artifacts

#WindowsForensics

RT @[email protected]

If you've been looking to learn more about Windows Forensics, the new Practical Windows Forensics course on TCM Academy is a great introduction course to get you started.

Learn more here: https://academy.tcm-sec.com/p/practical-windows-forensics

#forensics #windows #microsoft #windowsforensics #cybersecurity

🐦🔗: https://twitter.com/TCMSecurity/status/1545090348803825665