https://4n6post.com/tags/4n6/Recent content in 4n6 on 4n6Posthttps://4n6post.com/artifacts/registrydb-sam/2025-10-14SAM Database - Windows Security Account Manager Security Account Manager (SAM) database in short, is the critical components of Windows security architecture. It stores user account information, password hashes for local accounts, groups associations, and security policies for local accounts on Windows systems. When considering user accounts, the SAM database provides evidence about user accounts, authentication attempts, and insight on user activity and potential security compromises. Understanding how to properly extract, analyze, and interpret SAM data is essential for any serious Windows forensic investigation.https://4n6post.com/artifacts/mru/2024-10-02The MRU (Most Recently Used) registry is a database in Microsoft Windows that stores information about recently opened files, URLs, and other items. This information can be used for a variety of purposes, both benign and malicious. This is NOT the same as runMRU. Normal Use Case The MRU registry is commonly used by applications to keep track of recently opened files and other items. For example, a word processor might use the MRU registry to keep a list of the last ten documents a user has worked on.https://4n6post.com/artifacts/amcache.hve/2024-10-01Amcache.hve is a forensic artifact that can be used to uncover valuable information about a computer system, both in normal and malicious use cases. The Amcache.hve file is a hive file that is located in the Windows operating system, and it provides a wealth of information about the software and files that have been executed on the system. In normal use cases, the Amcache.hve file can be used to track software installations and updates, as well as to determine which files were recently executed on the system.https://4n6post.com/artifacts/registry-system-select/2024-01-01Windows Registry SYSTEM Select Key Analysis The Windows Registry is a hierarchical database that stores configuration information for the operating system, applications, and hardware devices. One of the key branches in the registry is SYSTEM\Select, which contains information about the system’s hardware configuration and boot options. The SYSTEM\Select subkeys and objects are as follows: Not all objects exist if they are not referred to, set or used in older versions.https://4n6post.com/artifacts/registry-start-shutdown-count/2023-10-01Windows Registry: System Start, Shutdown, and Reboot Tracking The Windows registry is a hierarchical database that stores configuration settings for Windows operating systems, including Windows 10, Windows 8, and Windows 7. The registry is organized into five main components, namely HKEY_CLASSES_ROOT, HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE, HKEY_USERS, and HKEY_CURRENT_CONFIG. Each of these components contains subkeys that store configuration data, including the data and time for when a computer turns on, shuts down, and restarts.https://4n6post.com/artifacts/shimcache/2023-10-01ShimCache - Windows Application Compatibility Cache for Digital Forensics Shimcache is a Windows artifact that stores information about programs that have been executed on a Windows machine. The Shimcache can be used for both benign and malicious purposes, making it a useful tool for system administrators, digital forensics analysts, and attackers. You should keep in mind that ShimCache and AMCache are very similar and depending on the version of Windows you are looking into, the AMCache might be more valuable to focus on.https://4n6post.com/artifacts/osinstalldatetime/2023-01-15The Windows registry is a central repository of configuration data for the Windows operating system and its applications. One important aspect of the registry is the section involving the Windows install time. This information can be used in a variety of ways, both for normal system usage and for malicious purposes. Finding the InstallDate/InstallTime Registry To find the registry section involving the Windows install time and timezone, you can navigate to the following location in the file system:https://4n6post.com/artifacts/addisablingtailoredexperience/2023-01-01Customizing Windows: Ad Disabling and Tailored Experience In the realm of Windows customization, users often seek ways to tailor their experience to suit personal preferences. This blog post explores a specific aspect of this customization - the modification of registry keys to disable ads in Windows and control tailored experiences. Disabling Ads in Windows What is it About? Windows often displays ads and promotes certain apps to users. However, not everyone appreciates this feature.https://4n6post.com/artifacts/enablingwindowsbsoddetail/2023-01-01Introduction By default, Windows displays a simple emoticon (smiley face) when a Blue Screen of Death (BSOD) occurs. However, if you prefer to see detailed information about the error, you can modify specific registry entries. This guide will walk you through the process. Disabling Ads in Windows What is it About? Windows often displays ads and promotes certain apps to users. However, not everyone appreciates this feature. To gain more control over your Windows experience, you can disable specific apps’ promotional activities using Registry Keys.https://4n6post.com/artifacts/shortcut-lnk/2023-01-01Windows users are likely familiar with .lnk files, also known as LNK Link files. These files are shortcuts that point to another file or folder on the computer, allowing users to quickly access their desired content. While LNK files are a convenient feature in Windows, they can also be exploited by malicious actors. In this post, we’ll explore LNK files, their normal use cases, and how they can be exploited by cybercriminals.https://4n6post.com/artifacts/jumplist/2023-01-01JumpList Forensics JumpList is a feature of Microsoft Windows operating systems that allows users to quickly access frequently used files, folders, and applications. This feature can be accessed by right-clicking on the taskbar icon or start menu tile of the target application. The JumpList registry holds the information that is displayed in the JumpList. This can be found multiple ways via Explorer File paths as well as within the registry itself.https://4n6post.com/artifacts/mft/2023-01-01MFT Analysis - Master File Table Forensics Guide The $MFT, or Master File Table, plays a crucial role in the NTFS (New Technology File System) utilized by Windows operating systems. Essentially acting as a master index for all files and directories on an NTFS volume, understanding the nuances of the $MFT file is vital for various professionals, including forensic investigators, system administrators, and security experts. In this blog post, we’ll thoroughly explore the $MFT file, examining its structure, functions, and its applications in both normal and potentially malicious scenarios.https://4n6post.com/artifacts/prefetch/2023-01-01Windows Prefetch Analysis - Digital Forensics Execution Tracking Windows Prefetch is a feature in the Windows operating system that was first introduced in Windows XP. It is a built-in tool that helps to speed up the loading of applications and other system processes by analyzing which files and libraries are most frequently used and then pre-loading them into memory. In this blog post, we will explore what Windows Prefetch is, how it works, and provide examples of both normal and malicious use cases.https://4n6post.com/artifacts/recycling.bin-recycler/2023-01-01The Recycling Bin is a well-known feature in Windows operating systems that acts as a temporary storage location for deleted files. However, what many users may not know is that the Recycling Bin is also a valuable forensic artifact that can provide valuable information in both normal and malicious use cases. In this blog post, we will explore the Recycling Bin and its role as a forensic artifact, including the connection between the “$I” and “$R” values created in the Master File Table (MFT), the normal and malicious use cases of the Recycling Bin, and how to permanently delete files to skip the Recycling Bin, as well as how to set the Recycling Bin in the registry.https://4n6post.com/artifacts/registry-sysinternals/2023-01-01SysInternals Tools - Registry Forensics and Analysis What is SysInternals? SysInternals is a suite of advanced system utilities for Microsoft Windows that provides deep technical insight into the operating system. These tools are designed to help IT professionals, system administrators, and software developers manage, troubleshoot, and diagnose Windows systems effectively. From process management to network monitoring, SysInternals offers a wide range of utilities that enhance system performance, security, and reliability.https://4n6post.com/artifacts/timezoneinformation/2023-01-01The Windows registry is a critical component of the Windows operating system. It stores important configuration data and settings that help the operating system function properly. One of the registry keys that play an important role in the functioning of the system is the TimeZoneInformation registry key. In this blog post, we’ll delve into the registry TimeZoneInformation, its connection with the Dynamic Link Library (DLL) it uses, and how it is used in both normal and malicious scenarios.https://4n6post.com/artifacts/typedpath/2023-01-01Registry Section of TypedPath: Understanding Its Importance in Digital Forensics The registry is an important aspect of a computer’s operating system, as it stores information about the configuration, settings, and installed software. In digital forensics, the registry can provide valuable information to investigators, as it can reveal data about software execution and system changes. The registry section of TypedPath is a digital forensics tool that can be used to extract information from the registry of a computer.https://4n6post.com/artifacts/windows_border_size/2023-01-01Exploring Windows Border Size Modification Welcome to our exploration of a subtle yet impactful customization in the Windows operating system. Today, we’ll delve into the world of Windows Border size modification and how a few Registry Keys can unlock a realm of personalization. Understanding Windows Border Customization Windows border size modification allows users to adjust the thickness of window borders in the Windows interface. This customization affects the visual appearance of application windows and can impact both usability and accessibility.https://4n6post.com/artifacts/windowsgenericinstallationkeys/2023-01-01SOURCE: https://www.windowsafg.com/keys.html This is just a copy of the data from the source windowafg. I make a copy so that others can find it. Generic Installation Keys All of the examples provided are installation keys only; they will not activate your installed version of Windows. They are the default keys that are inserted if you choose to skip entering a Product Key during the installation process. The product keys listed in this section can be used with any of the answer files and scripted examples.https://4n6post.com/artifacts/windows-usb-connection/2023-01-01USB connections are a commonly used method for transferring data between computers and other electronic devices. In Windows, the use of USB connections can affect the registry in several ways, including within the registry are the USB, USBSTOR and MountPoints keys. In this post, we’ll explore the connection between USB Mountpoints and the setupapi.dev.log, and provide examples of both normal and malicious use cases. USB Forensics Overview USB device forensics involves analyzing multiple Windows artifacts to track USB device usage, including:https://4n6post.com/artifacts/wmi-filter-query-consumer/2023-01-01Windows Management Instrumentation (WMI) is a Microsoft technology that provides a unified way of managing Windows operating systems and applications. WMI is a management infrastructure that is built into Windows operating systems, and it provides a standardized interface for accessing system management information. WMI is used by system administrators to gather information about the state of their systems, to automate system management tasks, and to perform remote administration. In this blog post, we will take a closer look at what WMI is, how it works, and some examples of its normal and malicious use cases.https://4n6post.com/artifacts/wordwheelquery/2023-01-01The Registry Section of WordWheelQuery: An Overview for Digital Forensic Investigators The WordWheelQuery registry section is a critical component for digital forensic investigations, as it contains information about the user’s search queries made using the Windows operating system. In this blog post, we’ll take a closer look at what exactly can be found in the WordWheelQuery registry section and its significance for both normal and malicious use cases. Finding the WordWheelQuery Registry What is the Significance of the Registry Section of WordWheelQuery?