🖥️
Windows DFIR
Ctrlk
  • Introduction
  • Windows Artifacts
    • Windows Quick Tips
    • Account Usage
    • Browser Usage
    • Processes
    • Cloud Storage
    • Deleted File or File Knowledge
      • WordWheelQuery (Win 7+)
      • ACMRU (Win XP)
      • Internet Explorer file:///
      • Last Visited MRU
      • Thumbs.db (Win XP)
      • Thumbcache
      • Recycle Bin
      • User Typed Paths
      • Windows Search Database
    • File Download
    • Folder/File Opening/Creation
    • Persistence
    • Physical Location
    • Program Execution
    • Shadow Copies
    • USB Usage
    • Windows Services
    • System Information
    • Event IDs
  • Windows DFIR & MITTR
    • Initial Access
    • Execution
    • Persistence
    • Privilege Escalation
    • Defense Evasion
    • Credential Access
    • Discovery
    • Lateral Movement
    • Collection
    • Command and Control
    • Exfiltration
    • Impact
  • SOC Related
    • Cached Credentials
    • Domain Controller Password Spraying
Powered by GitBook
Page cover
On this page

Was this helpful?

  1. Windows Artifacts

Deleted File or File Knowledge

WordWheelQuery (Win 7+)ACMRU (Win XP)Internet Explorer file:///Last Visited MRUThumbs.db (Win XP)ThumbcacheRecycle BinUser Typed PathsWindows Search Database
PreviousCloud StorageNextWordWheelQuery (Win 7+)

Last updated 1 year ago

Was this helpful?