πŸ”
Windows Forensic Handbook
Ctrlk
  • πŸ‘‹Welcome
  • Artifacts by Type
    • πŸ—„οΈRegistry Artifacts
    • πŸ“‚Filesystem Artifacts
    • πŸ“…Event Log Artifacts
      • Task Scheduler Operational Log
      • TerminalServices-RDPClient
      • Security
      • System
      • Microsoft Windows Windows Firewall With Advanced Security
      • TerminalServices-LocalSessionManager
      • TerminalServices-RemoteConnectionManager
      • Microsoft Windows Shell Core
      • Microsoft-Windows-PowerShell
  • Artifacts by Activity
    • πŸƒβ€β™‚οΈExecution
    • πŸ—’οΈFile Activity
    • πŸ‘¨β€πŸ”§Account Activity
    • 🌎Network Activity
    • πŸ”Browser Activity
    • πŸ–₯️System Enumeration
Powered by GitBook
On this page
  1. Artifacts by Type

πŸ“…Event Log Artifacts

Task Scheduler Operational LogTerminalServices-RDPClientSecuritySystemMicrosoft Windows Windows Firewall With Advanced SecurityTerminalServices-LocalSessionManagerTerminalServices-RemoteConnectionManagerMicrosoft Windows Shell CoreMicrosoft-Windows-PowerShell

Last updated 1 year ago