> For the complete documentation index, see [llms.txt](https://psmths.gitbook.io/windows-forensics/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://psmths.gitbook.io/windows-forensics/artifacts-by-type.md).

# Artifacts by Type

- [Registry Artifacts](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts.md)
- [Amcache.hve](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/amcache.md)
- [Background Activity Montitor](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/bam-dam.md)
- [Image File Execution Options Registry Keys](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/image-file-execution-options.md)
- [System Resource Usage Monitor (SRUM)](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/srum-db.md)
- [Run/RunOnce Registry Keys](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/reg-run-runonce.md)
- [Tracing Registry Keys](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/tracing-keys.md)
- [Services Registry Keys](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/registry-services.md)
- [Select Registry Key](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/select.md)
- [CurrentVersion Registry Key](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/current-version.md)
- [ComputerName Registry Key](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/computer-name.md)
- [Interfaces Registry Key](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/interfaces.md)
- [NetworkCards Registry Key](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/network-cards.md)
- [TimeZoneInformation Registry Key](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/registry-artifacts/time-zone-information.md)
- [Filesystem Artifacts](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts.md)
- [USN Journal](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/usn-journal.md)
- [Prefetch](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/prefetch.md)
- [AutomaticDestinations Jumplists](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/automatic-destinations.md)
- [Recycle Bin $I/$R Files](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/recycle-bin-files.md)
- [Task Scheduler Files](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/task-scheduler-files.md)
- [Windows Error Reporting Files (.WER)](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/filesystem-artifacts/wer-files.md)
- [Event Log Artifacts](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts.md)
- [Task Scheduler Operational Log](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/task-scheduler-operational-log.md)
- [TerminalServices-RDPClient](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-rdpclient.md)
- [EventID 1024: RDP ClientActiveX is trying to connect to the server](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-rdpclient/evtx-1024-rdp-activex.md)
- [Security](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/security.md)
- [EventID 4688: A new process has been created](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/security/evtx-4688-process-created.md)
- [EventID 4624: An account was successfully logged on](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/security/evtx-4624-successful-logon.md)
- [System](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/system.md)
- [Event ID 7045: Service Installed](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/system/evtx-7045-service-install.md)
- [Microsoft Windows Windows Firewall With Advanced Security](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security.md)
- [EventID 2004: Firewall Rule Added](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2004-firewall.md)
- [EventID 2005: Firewall Rule Modified](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2005-firewall.md)
- [EventID 2006: Firewall Rule Deleted](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2006-firewall.md)
- [EventID 2071: Firewall Rule Added](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2071-firewall-windows-11.md)
- [EventID 2073: Firewall Rule Modified](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2073-firewall-windows-11.md)
- [EventID 2052: Firewall Rule Deleted](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-windows-firewall-with-advanced-security/evtx-2052-firewall-windows-11.md)
- [TerminalServices-LocalSessionManager](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager.md)
- [EventID 21: Session logon succeeded](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager/terminal-services-local-21.md)
- [EventID 24: Session has been disconnected](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-localsessionmanager/terminal-services-local-24.md)
- [TerminalServices-RemoteConnectionManager](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-remoteconnectionmanager.md)
- [EventID 1149: User Authentication Succeeded](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/terminalservices-remoteconnectionmanager/terminal-services-remote-1149.md)
- [Microsoft Windows Shell Core](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-shell-core.md)
- [EventID 9707: Command Execution Started](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-shell-core/evtx-9707-shell-core.md)
- [Microsoft-Windows-PowerShell](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-powershell.md)
- [EventID 4104: PowerShell Script Block Logging](https://psmths.gitbook.io/windows-forensics/artifacts-by-type/event-log-artifacts/microsoft-windows-powershell/evtx-4104-script-block-logging.md)