FortiGuard IR researchers have highlighted unexpected forensic value in the AutoLogger-Diagtrack-Listener.etl file on modern Windows systems.

Despite low exploitation severity, the artefact has shown the ability to preserve historical process-execution data, including deleted binaries and command-line traces — helpful in ransomware investigations.

What’s your view on ETW-based artefacts in DFIR workflows?

Source: https://www.fortinet.com/blog/threat-research/uncovering-hidden-forensic-evidence-in-windows-mystery-of-autologger

Share your insights and follow us for more clear, unbiased analysis.

#InfoSec #DFIR #ThreatIntel #WindowsForensics #ETW #Telemetry #CyberSecurity #IncidentResponse #SecurityResearch #ThreatAnalysis

Deleted a folder? Shellbags is the accessory you need...

They’re one of the most valuable forensic artifacts for tracing user activity in Windows, even if the folders are gone.

This blog post by our Joseph Williams walks through how Shellbags work, how to analyse them with tools like ShellBags Explorer, and what they reveal about user navigation through local, external, and network locations.

If you're in DFIR, this is one artifact you don't want to miss.

📌 Read the blog: https://www.pentestpartners.com/security-blog/dfir-tools-and-techniques-for-tracing-user-footprints-through-shellbags/

#DFIR #DigitalForensics #WindowsForensics #IncidentResponse #Shellbags #CyberSecurity #ForensicAnalysis

Windows Registry Forensics 2025: https://www.cybertriage.com/blog/windows-registry-forensics-2025/

#WindowsRegistry #WindowsForensics

NTUSER.DAT Forensics Analysis 2025: https://www.cybertriage.com/blog/ntuser-dat-forensics-analysis-2025/

#WindowsForensics

Windows Registry Forensics Cheat Sheet 2025: https://www.cybertriage.com/blog/windows-registry-forensics-cheat-sheet-2025/

#WindowsRegistry #WindowsForensics #cheatsheet

Windows Event Log Forensics: Techniques, Tools, and Use Cases: https://belkasoft.com/windows-event-log-forensics

#windowseventlogs #WindowsForensics

Network Analysis via PowerShell: https://medium.com/@iramjack8/network-analysis-via-powershell-4f1a7460a19b

#networkforensics #WindowsForensics #powershell #digitalforensics

ShimCache vs AmCache: Key Windows Forensic Artifacts: https://www.magnetforensics.com/blog/shimcache-vs-amcache-key-windows-forensic-artifacts/

#digitalforensics #WindowsForensics #shimcache #amcache

Remote Desktop Application vs MSTSC Forensics: The RDP Artifacts You Might Be Missing: https://www.zerofox.com/blog/remote-desktop-application-vs-mstsc-forensics-the-rdp-artifacts-you-might-be-missing/

#rdp #WindowsForensics