DFIR Cheatsheet — Windows Registry & Filesystem Artifacts

Reference card for Windows forensics: where to find evidence of execution, staging and exfiltration. Based on the classic "kill chain" order: Execution → Persistence → Access → Collection → Exfiltration.

How to use this cheatsheet

Every DFIR CTF (and every real incident) follows roughly the same questions:

1. What was executed? (execution artifacts)
2. When? (timestamps, often FILETIME)
3. Which files/folders were touched? (access/enumeration artifacts)
4. Where was data collected? (staging)
5. What went out? (exfiltration)

When you get stuck, work down this list per category, instead of grepping blindly.

1. Execution Artifacts — "what was executed?"

UserAssist GUID cheat:

• {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} → EXE files launched directly
• {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} → linked files/shortcuts (.lnk)

Decoding FILETIME (Python):

import struct, datetime

def filetime_to_dt(hexstr):
    raw = bytes.fromhex(hexstr)
    ft = struct.unpack("<Q", raw)[0]
    return datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=ft/10)

print(filetime_to_dt("60d32c832447dc01"))

2. Access & Enumeration Artifacts — "what was viewed/opened?"

⚠️ Watch out: ShellBags live in UsrClass.dat, not in NTUSER.DAT. If you were only given NTUSER.DAT hives in a CTF, this artifact isn't available and you have to fall back to RecentDocs / ComDlg32 / WordWheelQuery.

3. Tool-specific traces (7-Zip, WinRAR, etc.)

⚠️ Important pitfall: a portable executable (e.g. 7za.exe command-line, run without installation) often writes nothing to these registry keys — no GUI dialog = no MRU entry. If you find nothing here despite clear archive use elsewhere (UserAssist shows e.g. 7z.exe as executed), the evidence is probably in:

• UserAssist (execution, no path details)
• Prefetch (which files were touched during execution — via strings in the .pf file)
• Filesystem timestamps of the archive itself ($MFT, $LogFile)

4. Staging & Exfiltration — "collected where, what went out?"

No fixed registry key for this — you reconstruct it from a combination of:

• ShellBags / RecentDocs → which folder was repeatedly visited around the time of interest (a staging folder often has a lot of activity in a short window)
• $MFT / $LogFile (NTFS metadata, outside the registry) → file creation/move timestamps
• UserAssist for the archiving tool → when the archive was created
• Network logs / firewall logs / browser history (if available) → where the archive went

5. Practical workflow (Mac/Linux, Python-based)

# Setup — use a pyenv/conda venv, not system Python
python3 -m venv ~/ctf-venv
source ~/ctf-venv/bin/activate
pip install regipy

# Dump a full hive
regipy-dump NTUSER.DAT -o dump.json

# Specific plugin (auto-decodes UserAssist ROT13)
regipy-plugins-run -p userassist_plugin NTUSER.DAT -o ua.json

# Targeted greps — work down the categories above
grep -i "recentdocs" dump.json
grep -i "typedpaths" dump.json
grep -i "wordwheelquery" dump.json
grep -i "pidlmru" dump.json
grep -i "7.zip\|archhistory\|panelpath" dump.json

RegRipper (Perl) as an alternative/supplement:

perl rip.pl -r NTUSER.DAT -p userassist
perl rip.pl -r NTUSER.DAT -p 7zip
perl rip.pl -l   # list of available plugins

6. External references

• SANS "Windows Forensic Analysis" poster/cheatsheet — the industry standard, print it out or keep it handy as a PDF.
• SANS "Registry Quick Find Chart"
• Eric Zimmerman's tools (Registry Explorer, RECmd, AppCompatCacheParser, PECmd) — Windows-only but the GUI is invaluable as a reference for which keys sit where.

Notes added during Cyber Apocalypse 2026 — CROWQUILL forensics challenge (project 1).