Articles and References

This page collects high-quality starting points for readers who want to go beyond the artifact guides. The per-artifact Further Details sections contain the most targeted low-level links.

Beginner DFIR orientation

• SANS Windows Forensic Analysis poster — a visual map of common Windows artifacts and locations.
• SANS Hunt Evil poster — practical hunting pivots and Windows investigation reminders.
• DFIR Artifact Museum — public artifact samples for learning and parser validation.
• Velociraptor artifact reference — collection-oriented descriptions and VQL implementations for many Windows artifacts.
• Plaso documentation — timeline concepts and parsers for cross-artifact analysis.

File-system artifacts

• Microsoft: Master File Table
• Microsoft Open Specifications: NTFS
• Microsoft: Change Journals
• Microsoft: USN_RECORD_V2
• Microsoft: Security descriptors and SDDL
• Microsoft Open Specifications: MS-DTYP — security descriptors, ACEs and conditional expressions.
• libfsntfs format documentation
• Omer Ben-Amram's mft parser
• dfir_ntfs — NTFS parser with INDX record and index-slack carving.
• INDXRipper — carves $I30 slack for file names.
• LogFileParser — detailed NTFS transaction-log research and parsing.
• ntfs-linker — correlates $LogFile, $MFT, and USN history.

Execution and inventory artifacts

• Eric Zimmerman's AmcacheParser
• Security Ronin amcache-forensic
• libyal libscca — Prefetch format/library work.
• Eric Zimmerman's PECmd
• Mandiant: Leveraging the Application Compatibility Cache in Forensic Investigations
• Eric Zimmerman's AppCompatCacheParser

User-activity artifacts

• Microsoft Open Specifications: Shell Link (MS-SHLLINK)
• Microsoft Open Specifications: Compound File Binary (MS-CFB)
• Eric Zimmerman's LECmd
• Eric Zimmerman's JLECmd
• LnkParse3
• Eric Zimmerman's SrumECmd
• Microsoft: Extensible Storage Engine

Registry and persistence

• Microsoft: Registry value types
• Maxim Suhanov's Windows registry format specification
• yarp and libregf — low-level hive parsing and recovery references.
• Eric Zimmerman's Registry Explorer / RECmd documentation
• Microsoft: Services registry tree
• Microsoft: Task Scheduler schema
• MITRE ATT&CK: Scheduled Task/Job
• Microsoft Open Specifications: SAM Remote Protocol

Defender and malware handling

• Microsoft: Restore quarantined files in Defender
• dissect.target Defender plugin
• defender-dump — a separate research/extraction implementation.
• FIRST Malware Analysis Fundamentals — handling and analysis resources.

Juntei parser projects

• ys-amcache-parser
• ys-ntfs-parser ($MFT, $I30, USN Journal, $LogFile, $Boot, $Secure:$SDS)
• ys-prefetch-parser
• ys-srum-parser
• ys-lnk-parser
• ys-jump-lists-parser
• ys-shimcache-parser
• ys-defender-history-parser
• ys-registry-parser

External material changes

Verify claims against the affected Windows version and your collected data. A useful article can describe a specific operating-system generation, parser version, or experiment rather than a universal rule.