Windows Endpoint Investigation: Ten Investigation Questions and How to Work Through Them

Introduction

The previous section established why Windows artifacts exist at all and what makes them evidence. This one is about the route through them, and about why that route is ordered the way it is rather than the way the artifacts themselves group.

By the end of this section you will be able to state what each of the ten modules asks and recognize those questions as ones you have been asked, say why the module order matches how a case is actually worked rather than how the artifacts would tidy up, describe the five-part shape every one of the ninety-three content subs follows, name the two capstone investigations and say what they demand that the modules do not, and use the course as a working reference after you have read it once, which is what most of its life will be.

The modules are named as questions rather than as topics on purpose. A topic is something you study and a question is something you answer, and every module here ends with an answer to its own.

The obvious way to organize a Windows forensics course is by artifact family, with the registry in one place, NTFS in another and the event logs somewhere else. This course deliberately does not do that, because nobody has ever worked a case in that order.

Read the arrow on the left. That sequence is what an examiner actually does, and the artifacts fall where the questions need them rather than where they would tidy up.

  MODULE  THE QUESTION IT ANSWERS

     1    How do I collect and preserve evidence before analyzing it?
     2    What programs executed, when, how often, and who launched them?
     3    Which accounts were active, what did they access and search for?
     4    What was the initial access, and how did they move between systems?
     5    What persistence exists, and when was it created?
     6    What was staged, uploaded, connected, and how much data moved?
     7    What files were created, modified, deleted, renamed, encrypted?
     8    What anti-forensic activity occurred, and what does it prove?
     9    How do I build one timeline and produce defensible findings?
    10    What was communicated, browsed, searched and shared?

The ten modules written as the questions they answer.

Every one of those is a sentence somebody has actually asked an examiner. None of them is the name of an artifact, and several of them are answered from three or four artifact families at once.

The artifact families, and how many modules each is needed in.

  ARTIFACT FAMILY      APPEARS IN MODULES        SUBS
  ------------------   -----------------------   ----
  Registry hives       2, 3, 4, 5, 8, 10           23
  NTFS metadata        1, 6, 7, 8, 9               19
  Windows event logs   1, 3, 4, 5, 8               17
  Execution caches     2, 4, 8                     11
  Application stores   6, 10                        9

  Organized by artifact, "which accounts were active and what
  did they access" would have been split across four modules
  and a student would meet a third of the answer at a time.

The counts in the right-hand column are subs rather than mentions, so they say how much of the course each family occupies. Twenty-three subs touching the registry is a quarter of the content, distributed across six different questions.

No family belongs to one module and no module draws on one family. That is the argument against organizing by artifact stated as a table rather than as an opinion.

The application stores line is the smallest and the most recent. It is where browsers, chat clients and synchronization clients live, and it is the family that changes fastest because it belongs to vendors rather than to Windows.

The registry line is the clearest case. Six modules need it, for execution counts, for account activity, for persistence, for what was concealed and for browser configuration, and a single registry module would have taught all six uses to somebody who had a question about one.

The ten modules with their weight and what each leaves you able to do.

  MODULE  SUBS   WHAT IT LEAVES YOU ABLE TO DO

     1     11    image a machine and defend the collection
     2     11    say what ran, when, how often, under whom
     3      9    place an account at a keyboard and a folder
     4     11    trace entry and movement between systems
     5     10    find what was installed to survive reboot
     6      8    quantify what left and by which channel
     7     12    order file operations to the millisecond
     8      8    read destruction as evidence in itself
     9      6    merge it all and write a defensible finding
    10      7    recover what was said, browsed and shared

           93    content subs, plus 20 across two investigations

A hundred and thirteen subs in total is the honest size of the course, and it is worth knowing before starting rather than discovering in Module 4. Nothing here is padding, and equally nothing here needs reading in one pass.

The right-hand column is written as capability rather than coverage, which is the same test each individual sub is held to. A module is finished when its question is answerable, not when its artifacts have been described.

Modules 6 and 8 are the two shortest of the evidence modules at eight subs each, and both are among the most likely to decide a case. Length reflects how many distinct techniques a question needs rather than how often the question gets asked.

The sub counts are worth reading as weight rather than as importance. Module 7 has twelve because filesystem ordering has that many distinct techniques in it, and Module 9 has six because a timeline is a small number of ideas applied to everything that came before.

There is a navigation consequence too, and it is the reason the module map exists on every index page. Because a question draws on several families, the map lists what each sub establishes rather than which artifact it covers, so choosing where to go is done on the question rather than on a filename.

There is a consequence for how the course reads that follows from this. An artifact you met in Module 2 will reappear in Module 5 answering a different question, and that is not repetition: the same registry key supports an execution finding and a persistence finding, and knowing it in one context does not mean knowing it in the other.

There is a second reason for questions over topics that shows up in the reading. A topic has no end condition, so a module about the registry is finished when the author stops writing, while a module asking which accounts were active is finished when that question is answerable. The questions bound the scope of each module rather than the author's judgment doing it.

The registry appears in six of those ten and NTFS in five, which is why organizing by artifact would have scattered every question across the course.

The sequence is not arbitrary and it is not the order the artifacts group in. Four things.

The second row generalizes past this course. Narrowing before attributing is the shape of most investigative work, because attribution is expensive and a window makes it cheap, and reversing the two produces a search across every account on a machine for an entire period.

The first row is the one that carries real cost. Collection decisions are made under time pressure at the start of a case, and the module covers them first because that is when they happen rather than because they are easy.

The fourth row is the one that gets questioned, since a timeline feels like it should come early. It would be readable early and it would not be interpretable, because a row naming a scheduled task or a shim database means nothing until the module that covers those has been read.

The third row is a genuine ordering claim rather than a convenience. Reading a timeline without knowing whether its gaps are real is how an examination reaches a confident wrong conclusion.

All ninety-three content subs across the ten modules share a single structure, and knowing it means you can navigate a sub you have never opened and find the part you need.

  Introduction     what this covers and what you will be able to do
  Scenario         the situation the technique is for
  Sections         teaching prose, each with something to look at
  Practice         steps to run on a machine you control
  Close            what the sub established, in prose

  ONE rc-scenario per sub. A log line later in the sub is a
  specimen to read, not a second scenario.

  Every section carries an artifact that is not a figure: a
  command to run, a specimen to judge, or a card to keep.

The five parts of a content sub, and two rules governing them.

The Practice section at the end of each sub is the part that matters most and the part most people skip. Reading a command and running it are different activities, and only one of them produces the recognition you need under time pressure.

Seven questions from real cases, each assigned to a module.

  A REAL QUESTION                          MODULE

  "did he email it to himself"                6
  "was that USB stick ever plugged in"        6
  "who deleted the share"                   3, 7
  "how long were they in before we saw it"    4
  "did they read the file or just have it"  3, 5
  "the log is empty for Tuesday, why"         8
  "can we prove it was her and not a
   shared account"                          3, 9

  Two of these map to two modules, and one of those
  two is always the corroborating source.

None of these names an artifact and all of them are answerable. That gap is what the module ordering exists to close, because the person asking does not know which registry key they need.

Three of the seven use the word prove or its equivalent, which is worth noticing at the start of a course rather than the end. What an examiner returns is what the artifacts establish, and the distance between that and what somebody wants proved is the subject of the ninth module.

The last two are worth reading closely. Both map to a primary module and a second one that corroborates, which is the confidence requirement from Module 9 showing up in the routing rather than only in the reporting.

There is a prerequisite question worth answering here because it comes up constantly. There are none beyond this module. Every artifact is explained at first use, no prior forensic experience is assumed, and where a concept from an earlier module is needed the sub that needs it says so and links back rather than assuming you retained it.

There is a reading strategy that follows from the structure and it is worth choosing deliberately. Reading the course in order builds the sequence a case is worked in. Reading a module when its question arrives builds nothing but answers the question you have. Both are legitimate, and the reference layer exists so the second one works.

There is a length figure worth stating so the commitment is clear. Content subs run to roughly three thousand words each, which across ninety-three of them is a substantial read, and the module map on each index is there so that a reader who needs one question answered is not obliged to work through the rest.

There is a rule about scenarios that matters for reading rather than only for writing. Each sub has exactly one, so a realistic-looking specimen appearing later is evidence to interpret rather than a new situation, and knowing that stops a reader holding two contexts in their head at once.

There is a rule about the sections themselves worth knowing as a reader. Every section carries something that is not a figure, meaning a command to run, a specimen to judge or a card to keep, so a section you can read without doing anything does not exist in this course by design.

There is a reason the introduction of each sub tells you what you will be able to do rather than what the sub is about. A list of contents lets you decide whether to read something; a statement of capability lets you decide whether you already have it, which is the more useful question on a second pass through the course.

The rule about one scenario per sub is worth knowing as a reader rather than only as an author. When you meet a second piece of realistic-looking output halfway through a sub, it is evidence to interpret rather than a new situation to hold in your head.

Two capstone modules follow the ten content modules, and they are a different kind of work entirely: no new artifacts are introduced, and no guidance is given about which one to reach for.

  INVESTIGATION 1   Insider threat, 10 subs
    A departing employee, a suspicion, and a laptop.
    You establish what was taken, by whom, and when,
    and the answer is smaller than the allegation.

  INVESTIGATION 2   Ransomware, 10 subs
    An encrypted estate and a demand.
    You establish the entry point, the dwell time,
    what was taken before encryption, and what the
    cleanup itself proves.

  Neither introduces an artifact the ten modules did not
  cover. Both withhold which one to use.

The two capstones, and what each of them withholds.

The difficulty in these is selection rather than technique. Every artifact you need has been taught, and the case does not say which of ninety-three techniques applies to the question in front of you.

A content sub and an investigation sub, side by side.

  A CONTENT SUB                        AN INVESTIGATION SUB

  names the artifact in its title      names a phase of a case
  tells you which field matters        gives you a machine
  one technique, explained             several would each
                                       produce an answer
  practice on your own machine         the evidence is supplied
  closes with what it established      closes with what you
                                       still cannot say

  The middle row is the whole difference.

Four of those five rows are presentational and the middle one is not. A content sub has an answer and an investigation sub has candidates.

The last row is the habit both formats share and it is the one that carries into real work. Every sub in this course ends by saying what its evidence does not establish, and the investigations end that way too.

There is a sequencing recommendation about the investigations that is worth following. Both assume all ten modules, and attempting one early produces the experience of being handed a machine and not knowing what to look at, which teaches nothing that reading the modules would not have taught faster.

There is a difference between the two capstones worth knowing before choosing which to start. The insider case is about establishing a small, precise answer against an allegation that is larger than the evidence supports, and the ransomware case is about reconstructing a large sequence under time pressure. They exercise opposite failure modes.

There is a reason both investigations are ten subs rather than one long case. A real examination has phases, and each sub is a phase that produces something the next one uses, so the structure teaches sequencing alongside technique rather than presenting a single problem to be solved in one sitting.

There is a second thing the investigations withhold that is easy to miss on the first read. The modules tell you when a technique applies; the investigations give you a machine on which several techniques would each produce a plausible answer, and choosing between them is the work.

That is the gap between knowing a subject and being able to work it, and it is deliberate. A module tells you which artifact this section is about; an investigation gives you a machine and a question.

Five things sit alongside the modules for the working moment rather than the learning one. Five things.

The second row is the format worth knowing about because it fits between the other two. A teaching sub explains why, a reference gives syntax, and a walkthrough shows one artifact taken from acquisition to finding in sequence, which is what somebody needs when they remember the method existed but not its steps.

The first row is the one that changes how the course gets used after the first read. Nobody re-reads a teaching sub to find a command line, and the reference layer exists so that nobody has to.

The fourth row exists because most of this material was reverse-engineered rather than published. Where a claim in this course rests on somebody's research rather than on vendor documentation, that is where the source is recorded, and on a contested finding the provenance of the format matters as much as the parse.

The fifth row is the one that outlasts the others. Everything else in this layer is a page on this site behind a subscription, and the study guide is a file on your machine, which matters at the point you change job and lose the login rather than at any point during the course.

The third row is worth knowing on day one even though it reads like an afterthought. A real case arrives as a situation rather than as an artifact, and the playbooks are the entry point that matches how the work actually starts.

The examiner who needs the folder-browsing artifact and does not remember which module covered it.

  THE QUESTION: which artifact records a folder that was browsed,
                on a machine where the directory is now deleted?

  WRONG ROUTE   read Module 3 from the start
                9 subs, roughly 25,000 words

  RIGHT ROUTE   the question is "who was here and what did they
                access", which is Module 3
                -> the operational reference for the syntax
                -> the walkthrough for the method end to end
                -> the sub itself only if the answer is disputed

  ShellBags. Registry, per user, survives the folder.

One real question, routed two ways.

The route is the point rather than the answer. Ten questions is a small enough list to hold in your head, and mapping a real question onto one of them is what turns a course you read once into something you can use.

The answer itself is worth noting for what it demonstrates. The artifact records how a folder was displayed, which means the record survives the folder, and that is the principle from the previous section arriving as a practical answer rather than as a claim.

The three-step route is also a fallback ladder rather than a preference. The reference answers it if you know what you are looking for, the walkthrough answers it if you remember the method existed, and the sub answers it if somebody is disputing the finding and you need the reasoning.

The mapping step is the one worth practicing deliberately. Turning a real question into one of ten is a small act that takes seconds, and it is what stops a search across the whole course from being the first move.

The wrong route in that block is not a strawman. Reading a module from the start is what people do when they half-remember where something was, and twenty-five thousand words is roughly what Module 3 costs to re-read for one artifact name.

The last line is what the reference layer returns in seconds. The sub that teaches it explains why the record survives the folder, and that explanation is only needed when somebody disputes the finding.

The obvious way to organize a Windows forensics course is by artifact family, with the registry in one place, NTFS in another and the event logs somewhere else. This course does not do that, because nobody works a case that way. The ten modules are named as questions rather than topics, each one a sentence somebody has genuinely asked an examiner, and several of them are answered from three or four artifact families at once. The registry appears in six of the ten and NTFS in five, so organizing by artifact would have scattered every real question across the whole course.

The order is the order a case is worked. Collection comes first because it is the only module where a mistake cannot be corrected by more work later. Execution comes before attribution because establishing that something ran identifies a window and a binary, and asking who did it without that window is a much larger search. Anti-forensics comes before the timeline rather than after it, because an hour with no events is either a quiet hour or a cleared log and the timeline cannot tell those apart on its own. And the timeline module comes last of the analysis modules because a merged row saying a Run key was written means nothing to somebody who has not yet met the registry.

Ninety-three content subs share one shape: an introduction, a single scenario, teaching sections that each carry something to look at, a practice section, and a close. Two capstone investigations follow, and they introduce no artifact the modules did not cover while withholding which of them to use, which is the difference between knowing a subject and being able to work it. Alongside all of that sits a reference layer for after the first read, because nobody re-reads a teaching sub to find a command line.