Home
Juntei is Yamato Security's cross-platform parser for Windows forensic artifacts that are not event logs. It turns collected evidence into consistent CSV, JSON, and JSONL records while preserving the context an investigator needs to avoid false conclusions.
From raw artifact to defensible conclusion¶
Juntei can tell you what an artifact records; this site explains what that record does and does not prove. Start with an artifact page even if you have never performed Windows DFIR before. Each guide covers its purpose, on-disk location, retention and collection caveats, parsing command, output fields, interpretation, correlations, and deeper reading.
-
File-system history
Use the
$MFTand USN Journal to reconstruct file existence, names, movement, deletion, metadata changes, and alternate data streams. -
Program evidence
Prefetch can strongly support execution. Amcache and ShimCache add inventory, path, hash, compatibility, and historical context—but require careful interpretation.
-
User activity
LNK files, Jump Lists, RecentDocs, and SRUM expose opened items, application activity, removable or network locations, resource use, and historical user context.
-
Security evidence
Defender quarantine can preserve threat labels, original paths, download origins, hashes, owners, and even safely recover quarantined bytes for isolated analysis.
-
Registry state
Read allocated and recoverable registry data, replay transaction logs, and inspect services, scheduled tasks, local accounts, and recent-document state.
-
Correlate, do not guess
No single artifact tells the whole story. The guides show how to combine independent sources into an evidence-backed timeline.
Forensic output is evidence, not a verdict
A path that looks suspicious is a lead. A timestamp may describe a file's metadata rather than execution. A missing record does not prove an action did not happen. Preserve source evidence, record tool versions and commands, and corroborate important conclusions.