In Windows, Jumplist files store a history of recently accessed files or activities associated with specific applications. In this blog post, I’ll explore the structure of this artifact, what it’s used for, and how it can be valuable in digital forensic investigations.
On Windows 11, Notepad stores a cache of recently opened files. This cache contains valuable information, such as file paths, file contents, and other useful data. In this article, we will examine the structure of the Notepad cache and provide a custom parser to extract this information for forensic investigations.
TLDR; $SDS is an artifact for NTFS file systems. This artifact contain security descriptors to all files and folders on the drive, which means it will contain information of the file owner and permissions of the file. I also wrote a Rust 🦀 parser for this artifact that you can download from my Github.
I decided to start a new blog post series that will focus on windows forensic artifacts. In these posts, I will try to go through all windows artifacts (at least until I get bored 😁), understand its structure, and write a rust parser for them.
certutil is a build-in tool on windows systems that is used to manage certificates. However certutil could be used to download files from the internet. In this blog we will take a look at the artifacts generated by certutil when downloading a file