Introduction
Microsoft Windows 11 is the latest major desktop operating system developed by Microsoft Corporation. Released in October 2021, Windows 11 introduced a redesigned user interface, enhanced security features, cloud integration, and improvements to system performance.
As one of the most widely deployed operating systems in both personal and enterprise environments, Windows 11 is a significant source of digital evidence during forensic investigations.
Digital forensic artefacts are traces of user and system activity stored throughout the operating system.
These artefacts allow investigators to reconstruct events, identify user actions, establish timelines, recover deleted data, and determine whether malicious or unauthorized activities occurred.
Windows 11 stores evidence across the file system, registry, event logs, memory, cloud synchronization services, and application databases.
This essay examines the most important forensic artefacts found within Windows 11 and explains their evidential value during digital investigations.
Windows 11 Architecture and Forensic Relevance
Windows 11 is built upon the Windows NT architecture and uses the NTFS file system by default. Every interaction with the operating system leaves traces that may persist long after the original activity occurred.
Forensic artefacts can reveal:
- User logon activity
- File creation and deletion
- Internet browsing history
- Application execution
- USB device usage
- Network connections
- Cloud synchronization activity
- System configuration changes
- Security incidents and malware infections
Investigators typically collect evidence using forensic imaging tools to preserve the integrity of the original data.
User Account Artefacts
Security Account Manager (SAM)
The SAM database contains information about local user accounts.
Location at \Windows\System32\Config\SAM
Evidence includes:
- User account names
- Security identifiers (SIDs)
- Password metadata
- Account creation information
- Account status
The SAM hive can help identify who used the device and when accounts were created.
User Profile Folders
Each user has a profile directory located at \Users\Username\
Important evidence includes:
- Documents
- Downloads
- Desktop files
- Pictures and videos
- Application data
User profiles often contain substantial evidence of daily activities.
Windows Registry Artefacts
The Windows Registry is one of the most important forensic sources.
Registry hives are named:
- NTUSER.DAT
- SYSTEM
- SOFTWARE
- SAM
- SECURITY
These files contain thousands of configuration settings and user activity records.
Recent Documents
Registry key located at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Provides evidence of:
- Recently opened files
- File names
- Access patterns
This helps establish document usage history.
RunMRU
Registry key located at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Stores commands entered into Windows + R.
Evidence includes:
- Executed commands
- Administrative actions
- User activity timeline
- UserAssist
Registry located at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist
Records:
- Program execution
- Launch counts
- Last execution times
Data is ROT13 encoded but easily decoded by forensic tools.
UserAssist is highly valuable for identifying application usage.
ShimCache (AppCompatCache)
Registry hive named SYSTEM.
Records:
- Executed applications
- File paths
- Compatibility information
Although not definitive proof of execution, ShimCache often indicates that a program existed and was likely run on the system.
AmCache
Located at \Windows\AppCompat\Programs\Amcache.hve
Stores:
- Executable metadata
- File hashes
- Installation records
- Program execution indicators
AmCache is frequently used in malware investigations.
File System Artefacts
NTFS Master File Table (MFT)
The MFT is the central database of NTFS.
Evidence includes:
- File names
- Creation times
- Modification times
- Access times
- File locations
Every file and directory typically has an MFT record.
The MFT is one of the most important artefacts in Windows forensics.
USN Journal
Location at $Extend\$UsnJrnl
Records:
- File creation
- File deletion
- Renaming events
- Modification activity
Even when files are deleted, evidence may remain in the USN Journal.
Recycle Bin
Location at C:\$Recycle.Bin
Contains:
- Deleted files
- Original file paths
- Deletion timestamps
This artefact can demonstrate attempts to remove evidence.
Link Files (LNK)
Location at C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent
Evidence includes:
- Recently accessed files
- Original file paths
- Network locations
- USB device references
LNK files often survive after the original file has been deleted.
Jump Lists
Location at AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
Records:
- Recently accessed documents
- Frequently used files
- Application activity
Jump Lists are valuable for reconstructing user behaviour.
Event Log Artefacts
Windows Event Logs provide a detailed timeline of system activities.
Location at C:\Windows\System32\winevt\Logs
Files use the:
- Plain text
- .evtx
- format.
Security Log
Key Event IDs include:
4624 – Successful logon
4625 – Failed logon
4634 – Logoff
4648 – Explicit credentials used
4720 – User account created
4726 – User account deleted
These events help determine user access patterns.
System Log
Records:
- System startup
- Shutdown events
- Driver installation
- Hardware changes
Useful for establishing timelines.
Application Log
Contains:
- Software errors
- Application crashes
- Installation events
Often useful during malware investigations.
Browser Artefacts
Microsoft Edge located at \Users\Username\AppData\Local\Microsoft\Edge\User Data
Evidence includes:
- Browsing history
- Downloads
- Cookies
- Search terms
- Saved passwords
- Autofill data
Since Edge is the default browser in Windows 11, it is commonly examined.
Google Chrome
Location at \Users\Username\AppData\Local\Google\Chrome\User Data
Artefacts include:
- History database
- Download records
- Session information
- Cached content
Chrome uses SQLite databases that are easily parsed by forensic tools.
Mozilla Firefox
Location at \Users\Username\AppData\Roaming\Mozilla\Firefox
Evidence includes:
- History
- Bookmarks
- Downloads
- Search activity
- USB Device Artefacts
Windows records extensive information regarding removable media.
Registry locations
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
HKLM\SYSTEM\MountedDevices
Evidence includes:
- Device serial numbers
- Manufacturer details
- First connection time
- Last connection time
- Drive letter assignments
These artefacts are essential in data theft investigations.
Prefetch Files
Location at \Windows\Prefetch
Files with a file extension *.pf
Evidence includes:
- Executed applications
- Execution count
- Last execution time
- Referenced files
Examples:
- CHROME.EXE.pf
- WINWORD.EXE.pf
- POWERSHELL.EXE.pf
Prefetch is one of the strongest indicators of program execution.
Memory Artefacts
RAM Analysis
Live memory can reveal:
- Running processes
- Encryption keys
- Network connections
- Open documents
- Malware activity
- User credentials
Memory acquisition should occur before system shutdown whenever possible.
Windows Timeline Artefacts
Windows 11 continues to generate activity history information through Microsoft account synchronization and related components.
Evidence may include:
- Opened files
- Application usage
- Activity timestamps
- Cross-device synchronization events
These artefacts can help establish user behaviour over extended periods.
OneDrive Artefacts
Windows 11 integrates closely with onedrive.com.
Evidence includes:
- Synced files
- Cloud activity
- Account information
- Upload and download events
Locations inlude \Users\Username\OneDrive and associated application databases.
Cloud evidence is increasingly important in modern investigations.
Windows Defender Artefacts
Windows Defender logs may reveal:
- Malware detections
- Quarantine actions
- Security scans
- Threat history
Location at \ProgramData\Microsoft\Windows Defender
These records can help establish whether malware was present on a system.
Network Artefacts
Windows maintains records of network activity.
Sources include:
- DHCP Logs
- Provide:
- Assigned IP addresses
- Lease times
- WLAN Profiles
Location at \ProgramData\Microsoft\Wlansvc
Evidence includes:
- Connected Wi-Fi networks
- SSIDs
- Authentication settings
- Network Registry Keys
Reveal:
- Historical network connections
- Connection timestamps
- Network names
- Deleted Data Artefacts
Even after deletion, evidence may remain in:
- Unallocated space
- Volume Shadow Copies
- Pagefile.sys
- Hiberfil.sys
- USN Journal
- Recycle Bin
- MFT records
These artefacts often allow investigators to recover evidence that users believed had been removed.
Challenges in Windows 11 Forensics
Several Windows 11 features can complicate investigations:
BitLocker Encryption
BitLocker can prevent access to storage without recovery keys.
Secure Boot
Protects system integrity and may affect forensic acquisition methods.
Cloud Synchronization
Evidence may exist both locally and remotely.
Virtualization-Based Security (VBS)
Introduces additional protections against credential theft and memory analysis.
Frequent Updates
Windows updates can alter artefact locations and logging behaviour.
Conclusion
Windows 11 contains a vast range of forensic artefacts that can provide investigators with detailed insight into user actions, system activity, application execution, internet usage, and security events.
Critical artefacts include the Registry, Event Logs, Prefetch files, MFT records, browser databases, USB history, memory captures, and cloud synchronization records.
When analysed collectively, these artefacts allow investigators to reconstruct timelines, recover deleted evidence, identify malicious activity, and present reliable findings in civil, criminal, and corporate investigations.
As Windows 11 continues to evolve with enhanced security and cloud integration, forensic practitioners must remain familiar with emerging artefacts and investigative techniques to ensure accurate and defensible examinations of digital evidence.
About Athena Forensics
For information on our computer forensic expert services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to conclusion of the matter.
We are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 14 years.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies and we do not disclose personal information to other companies or suppliers.
Our team are all security cleared and we offer non-disclosure agreements if required.
Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
