Artifact Guide¶
Windows preserves overlapping traces in the file system, registry, compatibility databases, user-interface history, resource accounting, and security products. Juntei parses these sources, but the investigator must still interpret what each source means.
Choose an artifact by question¶
| Investigation question | Start here | Corroborate with |
|---|---|---|
| Did this executable run? | Prefetch | ShimCache, SRUM, event logs |
| Was this file ever present? | Amcache, $MFT | USN Journal, $I30, ShimCache |
| When was a file created, renamed, or deleted? | USN Journal | $MFT, $I30, Defender quarantine |
| What name or timestamp existed before a metadata change? | $LogFile | $MFT, USN Journal, $I30 |
| Who owns a file, and who may change it? | $Secure:$SDS with $MFT | SAM, Security event logs |
| Which volume was a shortcut's or Prefetch file's target on? | $Boot | LNK, Prefetch, USB devices |
| What did a user open? | Jump Lists, LNK, RecentDocs | SRUM, Prefetch |
| Did a program transfer a large amount of data? | SRUM | Firewall, proxy, DNS, packet or EDR telemetry |
| Which websites did a user visit, and what did they download? | Web Browsers, Internet Explorer and Legacy Edge | Proxy and DNS logs, $MFT and USN Journal, Defender, SRUM |
| Who did a user exchange e-mail with, and what was attached? | Outlook | Mail server and gateway logs, $MFT and USN Journal, Defender, LNK and Jump Lists |
| Which clients and accounts used this server, and on which days? | User Access Logging (UAL) | Security event logs, SMB and RDP logs, firewall logs |
| Was persistence configured? | Services, TaskCache, Registry | Event logs, Prefetch, $MFT |
| What did Defender remove? | Defender Quarantine | Event logs, $MFT, USN Journal |
| Were local accounts added or changed? | SAM | Security event logs and registry transaction history |
Read warnings before fields¶
Every artifact page follows the same sequence:
- What it is and what questions it can answer.
- Where to find it and how collection affects it.
- What it proves—and does not prove.
- How to parse it with Juntei.
- How to read every output field.
- How to correlate it with independent evidence.
- Further Details for low-level research.
Do not equate a parser finding with maliciousness
Juntei findings identify patterns worth review, such as a system-binary name outside
System32. Installers, administrators, compatibility layers, and software updates can produce
unusual records. Validate with context and independent evidence.