Not yet available in English

This page does not exist in English yet. Shown is the version in Deutsch.

Windows-Artefakte

Pages in this section

• AmCache - Application Activity Cache
• BAM - Background Activity Moderator
• DAM - Desktop Activity Moderator
• EMDMgmt - ReadyBoost
• EventLogs
• LNK - JumpLists
• MRU - Most Recently Used
• MUI - Multilingual User Interface - Cache
• Office MRU
• Office Read Location
• Office Trust Records
• PCA - Program Compatibility Assistant
• PowerShell Command History
• Prefetch
• Recycle Bin
• Shellbags
• ShimCache - AppCompatCache
• SRUM - System Resource Utilization Monitor
• Superfetch
• Sysmon
• Thumbcache
• UAL - User Access Logging
• UserAssist
• USN Journal
• VSS - Volume Shadow Copy Service
• Windows AppIndex
• Windows Hello
• Windows Recall
• Windows Registry
• Windows Search Index
• Windows Timeline

Not covered yet

E.g. these entries are still missing. Contributions are welcome.

Program execution / app usage

• Windows Error Reporting
• RecentFileCache.bcf
• Sysinternals-EULA

File and folder access

• 7-Zip-Historie
• OAlerts

File existence and deletion

• Microsoft Defender

Communication

• Phone Link (Smartphone-Link)

Web activity

• Zone.Identifier (Mark of the Web)
• WebCache.dat

Data transfer

• OneDrive

Commands and input

• WordWheelQuery
• TypedPaths
• Notepad TabState

Accounts and logon

• SAM
• ProfileList

Network and remote access

• NetworkList
• WLAN-Profile und WLAN-AutoConfig
• RDP Bitmap Cache

External devices and connections

• USBSTOR / USB
• MountedDevices
• MountPoints2
• setupapi.dev.log
• Partition/Diagnostic-Log
• Windows Portable Devices

System and configuration

• Systeminformationen

Persistence / autostart

• Autostart-Einträge in der Registry
• Dienste
• Geplante Aufgaben