Written from engagements
What the work actually looks like.
Written for the person who has to do the work. Structures on disk, what the artifacts actually prove, and where the usual answer is wrong. Every claim here can be reproduced on a machine you control.
Nothing carries that combination of tags yet.
Everyone can list the artifacts. Almost nobody can rank them. Five tiers built on one question: who actually wrote the record, and could an attacker have written it instead.
Four letters, the same four you use on Windows, and almost every instinct you carry over is wrong. Access is usually not recorded, creation is not in the standard, and the one field an attacker cannot set is the one nobody looks at.
The same four times are stored more than once, and only one copy can be reached by the documented API. That asymmetry is the tell. Knowing the benign explanation for every tell is the rest of the answer.
The million dollar question of any DFIR interview, answered properly: every structure that changes, where the evidence survives, and the three places the standard answer is wrong.
