# Windows Forensics: File Systems and Artifacts

> Chapter 7 of the Courseiva EC-CHFI curriculum — https://courseiva.com/learn/ec-chfi/windows-forensics

**Official objective:** 5.1 — Analyze the Windows operating system for forensic evidence including file systems, registry, and logs.

## Introduction

How do you find out what someone did on a Windows computer after they have tried to hide their tracks? Understanding Windows forensics solves exactly this problem by teaching you how to read the digital 'memory' a computer never quite forgets. For the 312-49 exam, this is your foundation – without it, you cannot interpret evidence in any real-world investigation.

## The Filing Cabinet Analogy

A filing cabinet is the central object in a busy office. This cabinet is not just a metal box; it is a carefully organised system that stores every piece of paperwork the office has ever handled. Each drawer represents a different drive on a computer, like the C: drive or a USB stick. Inside each drawer, hanging folders are the file system's directories, grouping related documents together. Within those folders, individual file folders represent subdirectories. The papers themselves are the actual files – documents, spreadsheets, images.

The office manager keeps a detailed index card for every paper in the cabinet. This card is the Master File Table (MFT) on an NTFS drive. It records the paper's name, its size, where it physically sits (which drawer, which folder, and the exact spot in the folder), and even when it was last modified. If someone takes a paper out and later puts it back in a slightly different place, the index card is updated accordingly. If a paper is 'deleted', the office manager does not shred it immediately. Instead, they simply mark the index card entry as 'available for reuse'. The paper itself remains in the folder until a new paper needs that spot. This is exactly how Windows 'deletes' a file – it just marks the space as free on the MFT. The actual data lingers on the disk, waiting to be overwritten, which is the entire basis for file recovery in forensic investigations.

## Core explanation

Windows forensics is the science of recovering and analysing data from a Windows operating system to uncover evidence of user activity, system events, and potential crimes. At its core, it relies on understanding how Windows stores, organises, and eventually 'forgets' data. The key areas you need to know are file systems, the Registry, and logs.

A file system is the method Windows uses to name, organise, and retrieve data on a storage device like a hard drive or SSD. Think of it as the digital librarian that catalogues every file. The two most common file systems you will encounter are FAT32 (File Allocation Table, 32-bit) and NTFS (New Technology File System). NTFS is far more sophisticated and is the default for modern Windows installations. NTFS uses a database called the Master File Table (MFT). The MFT is like a card catalogue: it stores a record for every file and folder on the volume. Each record contains the file's name, its size, its timestamps (creation, last modified, last accessed), and crucially, the physical location of the data on the disk in clusters. Clusters are the smallest logical unit of storage. When you 'delete' a file in Windows, the operating system does not destroy the data. It simply marks the MFT entry for that file as 'available' and adds the clusters to a list of free space. The actual file content remains on the disk until those clusters are needed by a new file. This is why forensics tools can recover 'deleted' files – they read the raw data from the unallocated space.

Windows also maintains 'slack space'. Slack space is the leftover space between the end of a file's data and the end of the cluster it occupies. When a file does not fill an entire cluster, the remaining bytes are slack space, and they can contain fragments of old data from previous files that once occupied that cluster. Slack space is a rich source of forensic evidence because a deleted file's remnants often persist there even after the original file's MFT entry has been reused.

The Windows Registry is a central, hierarchical database that stores configuration settings for the operating system, hardware, software, and user preferences. Think of it as the computer's memory and control panel combined. The Registry is divided into hives, each storing a specific category of settings. The most forensically important hives include:

- SAM (Security Accounts Manager): Stores user account passwords in a hashed format.
- SYSTEM: Contains information about hardware, system services, and the startup configuration.
- SOFTWARE: Stores settings for installed applications.
- NTUSER.DAT: This hive is stored in each user's profile folder and records that user's specific settings, including desktop background, recently opened files (MRU lists – Most Recently Used), and browser history.

An artefact in forensics is any piece of digital information that can be used as evidence. Windows generates hundreds of artefacts all the time without user knowledge. For example, the 'Jump Lists' on the Start menu track which files you have recently opened with a specific program. The 'Prefetch' folder stores files (with a .pf extension) that track which applications are launched and how often, giving a timeline of program usage. The 'Recycle Bin' is another key artefact: when a user sends a file to the Recycle Bin, Windows renames the file and creates a special hidden file (INFO2 or $I and $R files on newer systems) that records the original file path and the deletion timestamp. Even clearing the Recycle Bin does not erase the file's data; it just removes those references, leaving the data in unallocated space.

Windows Event Logs are the most structured source of system activity. Windows uses the Event Tracing for Windows (ETW) framework to log events. Each log entry has a type: Information, Warning, Error, Audit Success, and Audit Failure. The two most important logs for forensics are the Security log and the System log. The Security log records logon and logoff events (Event IDs 4624 and 4634), account management (4720 for user creation), and policy changes. The System log records events from device drivers and system services. A forensic investigator analyses these logs to build a timeline of user actions, such as when a user logged in, launched a program, or accessed a file share.

One crucial aspect is volatility. Data in RAM (Random Access Memory) is lost when the computer powers off. But much of the data on the hard drive persists. The key is knowing where to look and how to interpret the data without altering it. The 'first responder' rule is to never turn on a suspect computer because booting it writes new data to the disk (to the page file, to logs, and to temporary files), potentially overwriting evidence. Instead, forensic examiners make a bit-for-bit copy (called a forensic image) of the hard drive using a write blocker, then analyse the copy. The original drive remains untouched.

## Real-world context

Let us imagine you are a junior forensic analyst at a mid-sized company. The HR department reports that an employee, Alex, is suspected of copying confidential client lists to a USB drive and then deleting the evidence before leaving for a competitor. Your job is to investigate.

Your first step is to seize Alex's company-issued laptop. You must not boot it up. You connect a write-blocker device to the laptop's hard drive. This hardware device allows you to read data from the drive but physically prevents any data from being written to it. Using a forensic acquisition tool like FTK Imager (a free tool from AccessData), you create a forensic image – a complete, sector-by-sector copy of the entire hard drive, including the MFT, boot sector, and all slack space. You then store this image on a secure external drive.

Now, you work from the image copy. You open the image in a forensic analysis platform like Autopsy (an open-source tool) or EnCase. First, you examine the MFT. You look for files that have been deleted. Autopsy can list all files in the MFT, including those marked as 'deleted'. You see several client list files (e.g., 'ClientList_Q4.xlsx') that appear with a red 'X' icon indicating deletion. You recover these files directly from the image.

Next, you examine the Registry. You use a tool like Registry Viewer (from AccessData) to load the NTUSER.DAT hive from Alex's user folder. You look at the MountPoints2 key, which lists all USB drives that have been connected to the laptop. You find a record for a device with a specific serial number that was plugged in. You also check the MRU lists in NTUSER.DAT to see if Alex opened the client list files on the day he allegedly copied them.

You then jump to the Prefetch files. Using a tool like WinPrefetchView, you sort the .pf files by last run time. You see that 'EXCEL.EXE' (Microsoft Excel) was launched around 3:00 PM on the suspected day – matching the time Alex claimed he was just 'checking email'. You also check the Recycle Bin artefacts. You find $I and $R files that show the original path to the client list files and the exact timestamp of deletion: 4:45 PM the same day.

Finally, you examine the Security Event Log. You load the image's Security.evtx file into Event Viewer (or a forensic log parser). You search for Event ID 4663 (An attempt was made to access an object). You find an entry that shows Alex's user account reading the 'ClientList_Q4.xlsx' file at 2:55 PM. You also find Event ID 64001 (Windows Filtering Platform – also records USB device connection) showing the USB drive serial number being connected at 2:50 PM.

To put it all together, you create a timeline using a tool like Plaso (log2timeline). The timeline shows: 2:50 PM – USB drive connected; 2:55 PM – file accessed; 3:05 PM – Excel launches; 4:45 PM – files deleted. The timeline is a clear, chronological story of Alex's actions. You compile this into a report that HR can use in its investigation. Without understanding file systems (MFT, slack space), Registry (USB artefacts, MRU lists), and logs (Security Event IDs), you would have no evidence at all.

## Exam focus

The 312-49 exam tests your understanding of Windows forensics at a foundational level. You will not be asked to perform a live acquisition, but you must know the theory cold. The exam focuses heavily on specific artefact locations, file system structures, and Registry keys. Expect multiple-choice questions that describe a scenario and ask which artefact or file would contain the evidence.

Key exam topics you must memorise:

- The Master File Table (MFT): Know that it contains records for every file and folder, and that a 'deleted' file's MFT entry is simply marked as free. The exam often asks: 'Where does Windows store the metadata about a file?' The answer is the MFT.
- Timestamps: NTFS tracks four timestamps per file: Modified (M), Accessed (A), Created (C), and Entry Modified (E) – collectively known as MACE. The exam will test which timestamp is updated when a file is renamed (Entry Modified) versus when its contents are changed (Modified).
- Slack Space: Expect a question like: 'What is leftover data found between the end of a file and the end of the cluster called?' The answer is slack space. Know the difference between RAM slack (from the end of the file to the end of the sector) and drive slack (from the end of the last sector to the end of the cluster).
- Registry Hives: You MUST know the five main hives (SAM, SYSTEM, SOFTWARE, SECURITY, NTUSER.DAT) and what each stores. A common question: 'Which Registry hive contains user-specific settings and recently used files?' Answer: NTUSER.DAT.
- USB Artefacts: The exam loves questions about USB device history. Key Registry keys include: 'SYSTEM\CurrentControlSet\Enum\USBSTOR' (lists all USB storage devices ever connected) and 'SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt' (contains last write timestamp for USB devices).
- Event Logs: Know the main Event IDs: 4624 (successful logon), 4625 (failed logon), 4634 (logoff), 4720 (user account created), 4663 (attempt to access an object). They often ask: 'Which Event ID indicates a successful logon?' Answer: 4624.
- Prefetch: Prefetch files are located in 'C:\Windows\Prefetch'. They have a .pf extension. The exam will ask what they track (application launch frequency and last run time).
- Recycle Bin: Know that on Windows Vista and later, the Recycle Bin uses $I and $R files. $I stores the original path and deletion timestamp; $R stores the actual file data. The exam might ask: 'Where does Windows store the original file path for a deleted file in the Recycle Bin?' Answer: The $I file.

Common traps on the exam:

- Confusing slack space with free space. Slack space is within a cluster that is allocated to a file; free space is on unallocated clusters.
- Thinking that clearing the Recycle Bin permanently erases the file. It does not; it only removes the index entry.
- Assuming that the Registry hive files are in one single location. They are scattered across the Windows directory and user profile folders.
- Mixing up Event IDs. 4624 vs. 4634, or 4720 vs. 4732 (user added to a group). Memorise a short list of the most common IDs.

To pass this section, you need to be able to look at a list of artefacts and instantly recognise which one applies to a given scenario. Practise with memory aids: for example, remember 'MACE' for timestamps and 'USN' (Update Sequence Number) for the journal that tracks file changes. Also, know the locations of key artefacts by heart: 'C:\Windows\Prefetch', 'C:\Windows\System32\winevt\Logs', and 'C:\Users\[Username]\NTUSER.DAT'.

## Step by step

1. **Seizure and Preservation** — The investigator physically secures the computer and ensures it is not turned on. A write blocker is attached to the hard drive to prevent any data from being written during the acquisition process. This step is critical because booting the system could overwrite evidence in the page file and event logs.
2. **Forensic Imaging** — Using a tool like FTK Imager, the investigator creates a bit-for-bit copy of the hard drive, including the Master File Table (MFT), boot sector, slack space, and all unallocated space. This image is the master copy for analysis, and the original drive is kept in secure storage as evidence.
3. **MFT Analysis** — The investigator opens the forensic image in a tool like Autopsy or EnCase. They examine the MFT to identify deleted files, their timestamps, and their original paths. Deleted files are highlighted, and the investigator can recover them from the unallocated space or slack space.
4. **Registry Examination** — The investigator loads the NTUSER.DAT hive from the user's profile into a registry viewer. They check the MountPoints2 key for USB device history, the MRU lists for recently accessed files, and the UserAssist key for program launch times. This reveals a timeline of user activity and connected devices.
5. **Log and Artefact Correlation** — Using a timeline creation tool like Plaso (log2timeline), the investigator correlates data from multiple sources: Event Logs (Security.evtx), Prefetch files, Recycle Bin records, and MFT timestamps. A coherent timeline of events is built, showing exactly when a file was accessed, when a USB drive was plugged in, and when data was deleted.
6. **Reporting and Documentation** — The investigator writes a forensic report that summarises the findings, including a detailed timeline, screenshots of key artefacts, and an explanation of the evidence. The report is written in clear, non-technical language for non-IT stakeholders like HR or legal counsel.

## Comparisons

### Master File Table (MFT) vs File Allocation Table (FAT)

**Master File Table (MFT):**
- Stores detailed metadata for every file and folder in a relational database-like structure.
- Supports file timestamps down to the nanosecond and includes timestamps for creation, modification, access, and entry modification (MACE).
- Can be recovered even after formatting in some cases, as the MFT is stored at the beginning of the volume.

**File Allocation Table (FAT):**
- Uses a simple linked list to track which clusters are allocated to which files, with no per-file metadata beyond name and size.
- Only stores timestamps with a resolution of 2 seconds and has no distinction between modification and access on older versions.
- Formatting a FAT volume often overwrites the root directory and file allocation table, making recovery more difficult.

### Event ID 4624 (Successful Logon) vs Event ID 4625 (Failed Logon)

**Event ID 4624 (Successful Logon):**
- Indicates a user successfully authenticated to the system.
- Records the logon type (interactive, network, service) and the source IP address if remote.
- Commonly used to build a timeline of when an account was actively used.

**Event ID 4625 (Failed Logon):**
- Indicates a user failed to authenticate, usually due to an incorrect password.
- Records the reason for failure (e.g., bad password, locked account).
- Frequent occurrences can indicate a brute-force attack or a user forgetting credentials.

### Prefetch (.pf) File vs Amcache.hve Registry Hive

**Prefetch (.pf) File:**
- Records the last run time, run count, and list of files loaded by an application.
- Located in C:\Windows\Prefetch.
- Primarily used for performance optimisation but provides a timeline of application execution.

**Amcache.hve Registry Hive:**
- Records information about every executable file that has been run on the system, including SHA-1 hash and file path.
- Located in C:\Windows\AppCompat\Programs\Amcache.hve.
- Used for application compatibility and provides a comprehensive list of all executed programs, including those no longer on the system.

### $I File (Recycle Bin Metadata) vs $R File (Recycle Bin Data)

**$I File (Recycle Bin Metadata):**
- Stores the original file path, file size, and deletion timestamp.
- Very small in size (usually a few hundred bytes).
- Essential for determining the source of a deleted file and the time it was deleted.

**$R File (Recycle Bin Data):**
- Stores the actual contents of the deleted file.
- Can be as large as the original file.
- Allows the investigator to recover the file's contents directly from the Recycle Bin.

### NTUSER.DAT (Per-User Registry Hive) vs SAM (Security Accounts Manager) Hive

**NTUSER.DAT (Per-User Registry Hive):**
- Stores user-specific settings: desktop configuration, MRU file lists, browser history, and application preferences.
- Located in each user's profile folder (C:\Users\[Username]\NTUSER.DAT).
- Loaded only when the user logs in.

**SAM (Security Accounts Manager) Hive:**
- Stores local user account credentials (username, hashed password) and security identifiers (SIDs).
- Located in C:\Windows\System32\config\SAM.
- Always loaded at system boot because it manages local authentication.

### Slack Space vs Unallocated Space

**Slack Space:**
- The leftover bytes within a cluster that is currently allocated to a file.
- Can contain fragments of old data from files that previously occupied that cluster.
- Smaller than unallocated space because it is confined to allocated clusters.

**Unallocated Space:**
- Clusters that are not currently allocated to any file, marked as free in the MFT.
- Can be very large, encompassing all 'deleted' files that have not been overwritten.
- Recovering data from here is easier because it does not require parsing within allocated boundaries.

## Diagram

_This diagram shows the workflow of a Windows forensic investigation, from seizing the computer to producing a final report._

```mermaid
flowchart TD
    A[Seized Computer] --> B[Hard Drive
 with Write Blocker]
    B --> C[Forensic Image
 (Bit-for-bit copy)]
    C --> D[MFT Analysis]
    C --> E[Registry
 Examination]
    C --> F[Event Log
 Review]
    D --> G[Deleted Files
 from Unallocated Space]
    E --> H[USB History
 & MRU Lists]
    F --> I[Security Events
 (4624, 4663)]
    G & H & I --> J[Timeline
 Construction]
    J --> K[Forensic
 Report]
```

## Common misconceptions

- **Misconception:** When you delete a file and empty the Recycle Bin, the file is gone forever. **Reality:** When you empty the Recycle Bin, Windows only removes the file's index entry from the MFT and marks its clusters as free. The actual file data remains on the disk until those clusters are overwritten by new data, which is why forensic tools can often recover it. (People are used to the physical metaphor of 'throwing something in the bin' where once collected, it is gone. In digital terms, the computer does not immediately erase the data for performance reasons.)
- **Misconception:** The Windows Registry is just one big file that you can open like a text document. **Reality:** The Registry is a collection of several discrete files called hives (e.g., SAM, SYSTEM, SOFTWARE, NTUSER.DAT) that are loaded into memory when the operating system runs. They are not flat text files; they are structured binary databases. (Most users only interact with the Registry through the Regedit tool, which presents it as a single tree. This hides the fact that the data comes from multiple physical files stored in different locations.)
- **Misconception:** Prefetch files only speed up application loading and have no forensic value. **Reality:** Prefetch files record the last run time and the number of times an application has been executed. They also contain a list of files loaded by the application during startup, giving forensic investigators a timeline of program usage and evidence of which files were accessed. (Microsoft's stated purpose for Prefetch is performance improvement, so beginners assume its forensic use is secondary or unintended, but it is a rich source of evidence.)
- **Misconception:** The Security Event Log only records failed login attempts. **Reality:** The Security Event Log records both successful and failed login attempts (Event IDs 4624 and 4625), as well as account management changes (like user creation, password changes), object access attempts (Event ID 4663), and many other policy-related events. (In everyday troubleshooting, users often check the Security log only when they have a login problem, so they mistakenly believe its scope is limited to failures.)
- **Misconception:** If a user disables the system's logging service, no evidence of their activity can be found. **Reality:** Even if logging is disabled, the operating system still creates other artefacts like Prefetch files, MFT timestamps, USBSTOR registry keys, and Recycle Bin records. Disabling the Event Log service only stops new events from being written, but it does not delete existing logs or prevent other artefacts from being created. (This mistake stems from confusing 'audit logs' with 'all forensic evidence'. Many beginners think logs are the only source of information, overlooking file system artefacts.)

## Key takeaways

- The Master File Table (MFT) is the central catalogue of every file and folder on an NTFS volume, and it marks a file as 'deleted' without erasing its data.
- Slack space is the leftover area in a cluster between the end of a file and the end of the cluster, often containing fragments of old deleted files.
- The Windows Registry is a collection of hives, not a single file; the NTUSER.DAT hive contains per-user settings and recently used file lists.
- USB device history is stored in the Registry key SYSTEM\CurrentControlSet\Enum\USBSTOR, which lists every USB storage device ever connected to the computer.
- Event ID 4624 indicates a successful logon, while Event ID 4625 indicates a failed logon; knowing these numbers is essential for the 312-49 exam.
- Prefetch files (.pf extension) in C:\Windows\Prefetch record the last execution time and run count of applications, providing a timeline of program usage.
- When a file is sent to the Recycle Bin on Windows Vista and later, a $I file stores the original path and deletion timestamp, and a $R file stores the actual data.
- A forensic image is a bit-for-bit copy of a storage device, created using a write blocker to ensure the original evidence is never altered.

## FAQ

**What is the difference between a forensic image and a regular backup?**

A forensic image is a bit-for-bit copy of the entire storage device, including deleted files, slack space, and unallocated space. A regular backup only copies files that are currently visible to the operating system, missing all hidden evidence.

**Can I recover a file that was deleted months ago?**

It depends on whether those disk clusters have been overwritten. If the clusters were reused by new files, the original data is gone. Forensic tools can only recover data from clusters that are still marked as free in the MFT.

**Where are deleted files stored before I empty the Recycle Bin?**

On Windows Vista and later, deleted files in the Recycle Bin are stored in the hidden 'C:\$Recycle.Bin' folder, with each user having a subfolder identified by their Security Identifier (SID). Files are renamed to $R (data) and $I (metadata).

**What does Event ID 4663 tell me?**

Event ID 4663 logs an attempt to access an object, such as a file, folder, or registry key. It records which user accessed it and whether the access was successful, making it valuable for tracing data exfiltration.

**How do I find out which USB drives were connected to a Windows computer?**

Check the Registry key 'SYSTEM\CurrentControlSet\Enum\USBSTOR'. It lists every USB storage device that has ever been connected, including the vendor ID, product ID, and serial number. Additionally, the 'SYSTEM\MountedDevices' key shows which drive letter was assigned.

**What is the difference between RAM slack and drive slack?**

RAM slack is the space from the end of the file to the end of the sector (512 bytes), which may contain system memory data. Drive slack is the space from the end of the last sector used by the file to the end of the cluster. Both can hold remnants of old data.

**Can I analyse a Windows computer's Registry without booting it?**

Yes. You can mount the forensic image and use a tool like Registry Viewer or RegRipper to load the hive files (e.g., NTUSER.DAT, SAM) directly from the image file, without running the original operating system.

## Check your understanding

1. **What is the name of the database in NTFS that stores a record for every file and folder on a volume?**

   Answer: The Master File Table (MFT).

2. **Which Registry key would you examine to find a list of every USB storage device ever connected to a Windows system?**

   Answer: The key is SYSTEM\CurrentControlSet\Enum\USBSTOR.

3. **What are the two files created in the Recycle Bin on Windows Vista and later when a file is deleted?**

   Answer: The $I file (stores original path and deletion timestamp) and the $R file (stores the actual file data).

4. **Which Event ID indicates a successful user logon event?**

   Answer: Event ID 4624.

5. **What is the term for the leftover space between the end of a file and the end of its allocated cluster, which may contain remnants of old data?**

   Answer: Slack space.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-chfi/windows-forensics