Introduction
TeamViewer is a legitimate remote access and remote administration application widely used for technical support, remote working, system administration, and file transfer.
From a digital forensic perspective, TeamViewer frequently becomes relevant during investigations involving:
- Unauthorized remote access.
- Insider threats.
- Data theft.
- Business email compromise.
- Fraud investigations.
- Harassment and coercion cases.
- Malware incidents.
- Unauthorized third-party access allegations.
Although TeamViewer is legitimate software, it may also be abused by attackers to gain persistent access to victim systems. Therefore, forensic investigators must determine:
- Whether TeamViewer was installed.
- When it was installed.
- When it was executed.
- Who connected.
- Whether files were transferred.
- Whether unattended access was configured.
- Whether evidence of remote sessions exists.
Investigation Objectives
A forensic examination typically attempts to answer:
- Was TeamViewer present?
- Which version was installed?
- When was it installed?
- Who used it?
- When was it executed?
- Was remote control enabled?
- Were files transferred?
- What remote systems connected?
- Was unattended access configured?
- Was TeamViewer subsequently removed?
TeamViewer Installation Artefacts
Windows Installation Locations
Common locations include:
C:\Program Files\TeamViewer\
C:\Program Files (x86)\TeamViewer\
Portable versions may execute from:
Downloads\
Desktop\
USB drives
Investigators should examine:
- Executable timestamps.
- Digital signatures.
- Version information.
- Prefetch files.
- Link files.
Registry Artefacts
Important registry locations include:
HKLM\Software\TeamViewer
HKCU\Software\TeamViewer
64-bit systems:
HKLM\Software\WOW6432Node\TeamViewer
These keys may contain:
- Installation dates.
- Configuration settings.
- User preferences.
- Client IDs.
- Session information.
User Configuration Files
User-specific configuration data is often located in:
C:\Users\<username>\AppData\Roaming\TeamViewer\
Files may include:
- TeamViewer.ini
- Connections_incoming.txt
- Connections.txt
These artefacts may reveal:
- Remote IDs.
- Connection history.
- Partner devices.
- User settings.
Log Files
One of the most valuable sources of evidence is TeamViewer logging.
Common locations:
C:\Program Files\TeamViewer\
or
C:\Users\<user>\AppData\Roaming\TeamViewer\
Examples:
TeamViewerXX_Logfile.log
TeamViewerXX_Logfile_old.log
Log entries may contain:
- Session start times.
- Session end times.
- Remote partner IDs.
- Authentication events.
- File transfer events.
- Connection failures.
Example:
2026/06/10 18:22:14 Connection established.
Partner ID: 123456789
Windows Event Logs
Investigators should examine:
- Application logs.
- System logs.
- Security logs.
Event IDs may reveal:
- Service installation.
- Application crashes.
- Program execution.
- Service starts and stops.
Useful tools:
- Event Viewer.
- EvtxECmd.
- Hayabusa.
Service Artefacts
TeamViewer commonly installs a Windows service named TeamViewer
Registry location within HKLM\SYSTEM\CurrentControlSet\Services\TeamViewer
Artefacts may identify:
- Service creation date.
- Startup type.
- Last execution.
- Executable path.
Prefetch Analysis
Windows Prefetch files can prove execution.
Examples:
- TEAMVIEWER.EXE-XXXXXXXX.pf
- TEAMVIEWER_SERVICE.EXE-XXXXXXXX.pf
Location:
C:\Windows\Prefetch\
Prefetch can reveal:
- Execution count.
- Last execution times.
- Associated files.
- Program activity.
Tools:
- PECmd.
- WinPrefetchView.
Jump Lists and Recent Files
Remote file transfers may leave evidence in:
- AutomaticDestinations
- CustomDestinations
Locations:
C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\
Investigators may discover:
- Opened files.
- Recently accessed documents.
- File transfer evidence.
LNK Files
Shortcut files may demonstrate execution.
Locations:
- Recent\
- Desktop\
- Downloads\
These may contain:
- Original file paths.
- Execution times.
- Volume serial numbers.
- USB device identifiers.
SRUM Analysis
The System Resource Usage Monitor can identify:
- Application execution.
- Network usage.
- Data transfer volumes.
Location:
C:\Windows\System32\sru\
SRUM may help demonstrate:
- TeamViewer network activity.
- Duration of activity.
- Data usage patterns.
Network Forensics
TeamViewer traffic typically uses outbound connections over:
- TCP 5938
- TCP 443
- TCP 80
Investigators may examine:
- Firewall logs.
- Router logs.
- Proxy logs.
- IDS logs.
- NetFlow records.
Domains may include *.teamviewer.com
DNS artefacts may exist in:
- DNS cache.
- Browser history.
- Network appliances.
Browser Artefacts
Evidence of TeamViewer downloads may exist within:
- Chrome history.
- Edge history.
- Firefox history.
Investigators should search for:
- teamviewer.com
- download.teamviewer.com
Potential evidence:
- Download timestamps.
- User accounts.
- Download locations.
File Transfer Artefacts
TeamViewer supports direct file transfer.
Evidence may include:
- Recent files.
- Shellbags.
- Jump Lists.
- USN Journal.
- $MFT entries.
Investigators should correlate:
- Session times.
- File creation times.
- User activity.
Memory Forensics
Live memory acquisition can reveal active sessions.
Tools:
- Volatility.
- Rekall.
Possible evidence:
- Running processes.
- Connection details.
- Remote IDs.
- Authentication tokens.
- Decrypted configuration data.
Process examples:
- TeamViewer.exe
- TeamViewer_Service.exe
Network connections may also be identified.
Windows Timeline
On supported versions of Windows, Timeline artefacts may contain:
- Program launches.
- User activities.
- Session timestamps.
Database ActivitiesCache.db
USB Artefacts
Portable TeamViewer versions frequently execute from removable media.
Investigators should examine:
- USBSTOR.
- SetupAPI logs.
- Shellbags.
- LNK files.
These artefacts may identify:
- Device serial numbers.
- First and last insertion times.
- Execution paths.
macOS Artefacts
Location /Applications/TeamViewer.app
Configuration files:
- ~/Library/Preferences/
- ~/Library/Application Support/TeamViewer/
Investigators should review:
- Unified logs.
- Application logs.
- Launch agents.
- Persistence mechanisms.
Linux Artefacts
Common location /opt/teamviewer/
Configuration location ~/.config/teamviewer/
Logs:
- /var/log/
- journalctl
Investigators should examine:
- Package installation records.
- Systemd services.
- Bash history.
- Authentication logs.
Mobile Device Artefacts
Android
Potential location /data/data/com.teamviewer.*
Evidence may include:
- Installation dates.
- Account information.
- Cached sessions.
- Configuration data.
iOS
Potential evidence sources:
- Application containers.
- SQLite databases.
- Application logs.
- Backup artefacts.
Timeline Reconstruction
A forensic timeline may look like:
Time Event
09:12 TeamViewer downloaded
09:15 Installation completed
09:16 Service installed
09:18 First execution
09:20 Remote session established
09:45 File transfer occurred
09:52 Session disconnected
10:10 TeamViewer removed
Correlating multiple artefacts significantly increases evidential confidence.
Anti-Forensic Considerations
Suspects may attempt to remove evidence by:
- Uninstalling TeamViewer.
- Deleting logs.
- Using portable versions.
- Clearing browser history.
- Deleting Prefetch files.
- Wiping temporary files.
However, evidence often remains within:
- USN Journal.
- Volume Shadow Copies.
- Registry transaction logs.
- Unallocated space.
- Memory captures.
- Backups.
Evidential Value
The strongest evidence typically comes from:
- TeamViewer log files.
- Prefetch execution evidence.
- Registry artefacts.
- Network logs.
- Event logs.
- SRUM records.
- Browser history.
- Memory analysis.
- File transfer artefacts.
- Timeline correlation.
Conclusion
TeamViewer investigations require the correlation of application artefacts, operating system evidence, network records, and user activity. No single artefact proves remote access in isolation.
However, combining logs, execution evidence, network activity, and timeline analysis enables investigators to determine:
- Whether TeamViewer was installed.
- When it was used.
- Which systems connected.
- Whether file transfers occurred.
- Whether unauthorized remote access took place.
From a digital forensic perspective, TeamViewer frequently provides valuable evidence in cases involving unauthorized access, insider threats, fraud, and remote compromise investigations.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
