Prefetch rapid triage
CSV and timeline — run `PECmd.exe -d "E:\C\Windows\Prefetch" -q --csv G:\Output\<case>\prefetch --csvf prefetch.csv`; produces two outputs: a per-file `prefetch.csv` and a `prefetch_Timeline.csv` that arranges all embedded timestamps in chronological order
Timeline Explorer initial filters
Apply path filters `\temp\`, `\tmp\`, `\update\`, `\appdata\`, `\recycle`, `\download` to find suspicious execution paths; single- or two-character executable names (`a.exe`, `bhv.exe`) are anomaly indicators
Individual .pf detailed analysis
Run `PECmd.exe -f "E:\C\Windows\Prefetch\<TOOL>-<HASH>.pf"` for the suspicious tool; examine run count, up to 8 embedded timestamps on Win8+ systems, referenced files (user profile directory, tool staging path), and whether multiple .pf files exist with the same name (execution from different locations)
User identification via indirect method
If `C:\Users\<user>\Documents\PowerShell_transcript*` or similar user profile directories appear among Prefetch referenced files, this constitutes indirect evidence of which account executed the tool
ShimCache analysis
Deleted tools and renaming — `AppCompatCacheParser.exe -f "E:\C\Windows\System32\config\SYSTEM" --csv G:\Output\<case>\shimcache --csvf shimcache.csv`; the same `LastModifiedTime` + different name combination is evidence of renaming; UNC paths (`\\IP\c$\...`) indicate lateral movement traces; a smaller `CacheEntryPosition` value indicates a more recent entry
ShimCache limitation
Not execution evidence — from Windows Vista onward, a ShimCache entry is evidence of presence, not execution; browsing a folder with Windows File Explorer can create an entry; the claim "the tool was executed" must not be made without cross-validation with Prefetch or BAM/DAM
Amcache SHA-1 identification
`AmcacheParser.exe -f "E:\C\Windows\AppCompat\Programs\Amcache.hve" --csv G:\Output\<case>\amcache`; `amcache_UnassociatedFileEntries.csv` is the primary table for standalone tools; `amcache_DriverBinaries.csv` is critical for loaded drivers (rootkit/BYOVD investigation); `amcache_ProgramEntries.csv` is for installed applications
SHA-1 investigation flow
After stripping the first 4 zeros from the `FileID` column, the remaining value is the SHA-1; query it in VirusTotal, MATI, or MISP; if no match, examine `LinkDate` (PE compile time), `Publisher`, and file path; if the file is above ~31.4 MB the hash may not have been recorded — perform path validation with Prefetch and ShimCache
Amcache
Execution evidence nuance — Amcache should be used as evidence of presence and identity; Blanche Lagny's research distinguishes three categories: shimmed GUI applications (may be considered execution evidence), installation packages (not execution evidence), and Compatibility Appraiser scan hits (merely existing in Program Files/Desktop is sufficient — not execution evidence)
BAM/DAM user context validation
`RECmd.exe -f "E:\C\Windows\System32\config\SYSTEM" --bn BatchExamples\BasicInfo.reb --csv G:\Output\<case>\bam`; location: `SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\{SID}\`; on older Win10 1709 patch levels the `\State\` subkey does not exist (also try `...\bam\UserSettings\{SID}` path); on servers where Prefetch is disabled, BAM/DAM is the primary execution evidence
SRUM network activity and exfiltration detection
`SrumECmd.exe -f "E:\C\Windows\System32\sru\SRUDB.dat" -r "E:\C\Windows\System32\config\SOFTWARE" --csv G:\Output\<case>\srum`; an abnormally high `BytesSent` value for the suspicious tool in the `NetworkUsages.csv` table is an exfiltration indicator; even if the tool has been deleted, the SRUM record persists for up to 30 days; on a live system `SRUDB.dat` is locked by the OS — use VSS or the Velociraptor `raw_file` accessor
Anti-forensics
Prefetch absence check — if a tool appears in Amcache or ShimCache but no `.pf` file exists: check the `EnablePrefetcher` registry value (0=disabled); search for a `FILE_DELETE` record for `C:\Windows\Prefetch\*.pf` in $UsnJrnl (`MFTECmd.exe -f "E:\$Extend\$UsnJrnl:$J" --csv G:\Output\<case>\usnjrnl --csvf usnjrnl.csv`, Timeline Explorer filter: FileName `.pf` + Reason `FILE_DELETE`); remember that Prefetch is disabled by default on Windows Server
Timestomping detection
If the last-modified time recorded in ShimCache differs from the file's current `$SI` last-modified time, the timestamp has been manipulated; run `MFTECmd.exe -f "E:\$MFT" --csv G:\Output\<case>\mft --csvf mft.csv` for a `$SI < $FN` comparison over the `$MFT`
Artifact cross-validation and timeline
Merge `prefetch_Timeline.csv`, `shimcache.csv`, `amcache_UnassociatedFileEntries.csv`, BAM CSV, `usnjrnl.csv`, and `srum_NetworkUsages.csv` in Timeline Explorer; seek answers to the questions "when did the tool first arrive, when was it executed, which user, how many times, where was it moved, was it deleted?"; no single artifact provides definitive evidence on its own
Decision tree
Evidence assessment — present in Prefetch: strong execution evidence; only in ShimCache: presence evidence + investigate anti-forensics; only in Amcache: obtain SHA-1, execution is suspected; only in BAM/DAM: strong execution evidence + obtain SID; visible in multiple artifacts: confidence increases; artifacts conflict with each other: consider timestomping or manipulation
