Windows Digital Investigation Guide
Forensics & Incident Response

ForenShield is designed to be simple to pick up: a portable executable, no heavy install.

1. Download the latest version (coming soon).
2. Unzip the archive if needed.
3. Launch ForenShield.exe as administrator for full access to system artifacts.
4. Access the modules from the dashboard.

The interface aims for clarity: less "blah blah", more concrete actions.

• Dashboard: quick access to modules and actions.
• Modules: grouped by artifact family (process, registry, network...).
• Status bar: progress + collection logs.
• Exports: report generation and result saving.

Every serious investigation follows a structured framework. The PICERL model (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) is the SOC/CERT reference.

1. Preparation: tools at hand, tested backups, emergency contacts defined. Don't wait for the incident.
2. Identification: qualify the compromise — false positive or real? Scope the perimeter, timestamp the start of the incident.
3. Containment: isolate the system(s) without shutting down (to preserve live memory). Capture a RAM dump as a priority.
4. Eradication: identify the root cause (malware, stolen credentials, misconfiguration), then remove and patch.
5. Recovery: return to production carefully, with enhanced monitoring. Confirm there's no residual persistence.
6. Lessons Learned: write the final report, document the IoCs (Indicators of Compromise), strengthen detection rules.

Chain of custody: every action must be timestamped and documented from the start, especially for legal cases.

Windows generates massive execution traces. Here are the priority locations for a Windows forensic investigation.

• Prefetch — C:\Windows\Prefetch\*.pf: proof of program execution with timestamp and launch count (up to 128 entries on Windows 10+).
• LNK / Jump Lists — %APPDATA%\Microsoft\Windows\Recent\: recently opened files, with source path and full timestamps.
• Registry Run keys — HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run[Once]: classic location for malicious persistence.
• ShimCache / AppCompatCache — HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache: history of executables, even without proof of actual execution.
• AmCache — C:\Windows\AppCompat\Programs\Amcache.hve: SHA1 of executed binaries — useful for identifying malicious hashes with no antivirus trace.
• SRUM (System Resource Usage Monitor) — C:\Windows\System32\sru\SRUDB.dat: network and CPU usage per application over the last 60 days.
• Event Logs — C:\Windows\System32\winevt\Logs\: Security.evtx, System.evtx, Application.evtx. Filter by priority Event ID (see next section).
• $MFT (Master File Table): the NTFS reference for all files with 4 timestamps (creation, modification, access, metadata). Extractable with FTK Imager or dedicated tools.

Reports are designed to be readable, actionable, and directly usable in a professional context.

• Executive summary + detailed sections per module.
• Timestamping and "evidence / context / interpretation" structure.
• Highlighted detections + items worth investigating further.
• HTML export for quick sharing and legal archiving.

Goal: the report can be used as-is in an incident log or a CERT/SOC summary.

Before running a suspicious file in a sandbox, static triage lets you quickly qualify a sample with no risk of infection.

• Hash & reputation: compute MD5/SHA256, submit to VirusTotal, MalwareBazaar or Hybrid Analysis. A known hash means immediate classification.
• Strings: extracting printable strings — look for hardcoded URLs, suspicious API names (VirtualAlloc, WriteProcessMemory, CreateRemoteThread), paths and mutexes.
• PE Headers: check the compiler timestamp, high-entropy sections (encrypted/packed code), missing or minimal imports (sign of packing).
• YARA rules: apply community rules (YARA-Rules GitHub, Elastic Security rules, reversing.fr signatures) for signature-based detection.
• MITRE ATT&CK®: map the identified techniques — T1059.001 (PowerShell), T1547.001 (Registry Run Keys), T1003 (Credential Dumping), T1071 (C2 over HTTP/S).
• Dynamic sandbox: if static triage isn't enough, use Any.run, Cuckoo, Joe Sandbox or Triage.abuse.ch for behavioral analysis.

Analyze suspicious emails directly with the ForenShield EML Analyzer: SMTP header extraction, attachments, phishing indicators and reputation lookups.

The Windows security log (Security.evtx) is the richest source of events. Here are the priority Event IDs to watch during incident response.

• 4624: Successful logon. Type 2 = interactive, Type 3 = network (SMB/RPC), Type 10 = RDP. A stream of Type 3 from external IPs = potential lateral movement.
• 4625: Failed logon. High volume on the same account = brute force or password spraying (see the password audit tool).
• 4648: Logon with explicit credentials (runas or pass-the-hash). A frequent sign of lateral movement.
• 4688: New process created. Look for cmd.exe or powershell.exe -EncodedCommand, or processes launched from svchost.exe in an unusual way.
• 4698 / 4702: Scheduled task created / modified. A very common persistence vector — check the action and the executable path.
• 4720: User account created. An account created outside business hours or with a generic name deserves investigation.
• 7045 / 4697: Service installed. A classic persistence technique — check the binary path and the service description.
• 1102: Audit log cleared (Security log cleared). Often triggered by an attacker to erase their tracks — critical alert.
• 4656 + Sysmon Event 10: Access to the lsass.exe process — indicator of a credential dumping attempt (Mimikatz, Procdump).

Score the severity of a CVE exploited during the incident with the ForenShield CVSS Calculator.

The guide (and the tool) is designed for several levels.

• SOC / CSIRT: initial response, collection, prioritization.
• Consultants: audit, on-site investigation at a client.
• Admins: security checks and controls.
• Students: learn Windows forensics hands-on.

Paid versions will unlock extended capabilities (roadmap).

• Memory analysis (Volatility-style), custom rules.
• Automation (batch / recurring tasks).
• API integrations (interop with the security ecosystem).
• Priority support.

An issue, an idea, a bug: a clear channel, a clear answer.

• FAQ / Knowledge base: (coming soon)
• Community forum: (coming soon)
• Issues: GitHub
• Pro/Enterprise: dedicated priority support.