Written from engagements
Written for the person who has to do the work. Structures on disk, what the artifacts actually prove, and where the usual answer is wrong. Every claim here can be reproduced on a machine you control.
Subscribe by RSSNothing carries that combination of tags yet.
A drive attached 29 times, given a letter and opened in Explorer, was refused by endpoint policy for 15 hours. The standard USB reading gets that laptop wrong in both directions. The Defender and NTFS records that correct it, and a second drive that only looks used, set side by side with the published material.
A Windows 11 feature update can make a host look freshly reinstalled. It rebuilds execution evidence and every event log, replays the user registry with its write times reset, and plants two timestamp traps. Measured source by source on a real case and a controlled upgrade, with the sources that still reach behind it.
Most answers stop at five artifacts. This reference groups 157 event IDs and 14 on-disk artifacts into thirteen classes by the question each one answers, and tags each by whether it exists on a host nobody prepared.
Four letters, the same four you use on Windows, and almost every instinct you carry over is wrong. Most reads leave no trace in access time, creation is not in the standard, and the one field no timestamp interface can set is the one nobody looks at.
The same four times are stored more than once, and only one copy can be reached by the documented API. That asymmetry is the tell. Knowing the benign explanation for every tell is the rest of the answer.
The million dollar question of any DFIR interview, answered properly: every structure that changes, where the evidence survives, and the three places the standard answer is wrong.
