Old

⛅️ Cloud Storage

Windows For OneDrive the most useful artifacts are stored locally. If you get access to the account online - may see the deleted items and their versions.

🖥 System Information

Windows Installed programs and applications Key 🔑: Microsoft\Windows\CurrentVersion\Uninstall. There can be some data for programs that do not exist on the system anymore.

Collection Most of the devices keep some logs. As for the network-related issues are switches, routers, firewalls, IDS and IPS, web proxies, DC and authentication servers, DCHP servers and application servers.

📚 OSINT Techniques

This all about searching for the information publicly available.

💬❗️Notifications

Windows Toast notifications on Windows 10: C:\Users\%Username%\AppData\Local\Microsoft\Windows\Notifications contains wpndatabase.db and appdb.dat. Both can be opened with 🛠 SQLite Browser.

🗣 Voice Assistants

Windows Cortana is a great source of information. C:\Users\%Username%\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\ESEDatabase_CortanaCoreInstance\CortanaCoreDb.db contains user locations, reminders etc. Use a 🛠 SQLite browser to see the contents, or export to cvs and work in Excel.

🛡️ Defence Mechanisms

In this section, I will collect different defence mechanisms, bypass techniques and possible artefacts to look out for.

Misc

📈 User Statistics

This is about … .

🔦 Search History

This is about … .

Legal Acts

This is about … .