## Windows Artifacts: Where the Secrets Hides

Windows is a messy roommate. It keeps records of *everything* you do to improve "User Experience". Forensics exploits this.

### 1. Prefetch
*   **Location**: `C:WindowsPrefetch`
*   **Purpose**: Speed up app loading.
*   **Artifact**: Shows **Name of Executable** run, **First/Last Run Time**, and **Run Count**.
*   **Use**: "Did the suspect run CCleaner? Yes, 5 times. Last time was 10 minutes before we arrived."

### 2. ShimCache (AppCompatCache)
*   **Location**: Registry (SYSTEM hive).
*   **Purpose**: Compatibility settings for old apps.
*   **Artifact**: Tracks executables present on the system, even if they were deleted.
*   **Use**: Proving that `malware.exe` existed on the system in the past.

### 3. Jump Lists & LNK Files
*   **Location**: User Profile.
*   **Purpose**: "Recent Files" in Taskbar/Start Menu.
*   **Artifact**: Shows files accessed by the user.
*   **Use**: "The user opened `stolen_plans.pdf` from a USB drive `E:`."

### 4. Registry Hives
*   **SAM**: User accounts, password hashes.
*   **SYSTEM**: System config, Timezone, USB history (**USBStor** - proves a specific USB serial number was plugged in).
*   **SOFTWARE**: Installed programs, Versions.
*   **NTUSER.DAT**: Per-user settings. "Recent Docs", Search History, Typed URLs in IE/Explorer.

### 5. Amcache.hve
*   **Use**: Stores SHA1 hashes of executed programs.
*   **Golden**: You can map a file hash to a timestamp of execution.

### 6. Shellbags
*   **Location**: Registry (USRCLASS.DAT).
*   **Use**: Tracks which **Founders/Directories** the user browsed in Explorer.
*   **Power**: It persists even if the folder is deleted. You can construct a map of the user's file system knowledge.