RSS Feed


⛅️ Cloud Storage

Windows For OneDrive the most useful artifacts are stored locally. If you get access to the account online - may see the deleted items and their versions.

πŸ–₯ System Information

Windows Installed programs and applications Key πŸ”‘: Microsoft\Windows\CurrentVersion\Uninstall. There can be some data for programs that do not exist on the system anymore.

🌎 Network Traffic

Collection Most of the devices keep some logs. As for the network-related issues are switches, routers, firewalls, IDS and IPS, web proxies, DC and authentication servers, DCHP servers and application servers.

πŸ“š OSINT Techniques

This all about searching for the information publicly available.


Windows Toast notifications on Windows 10: C:\Users\%Username%\AppData\Local\Microsoft\Windows\Notifications contains wpndatabase.db and appdb.dat. Both can be opened with πŸ›  SQLite Browser.

πŸ—£ Voice Assistants

Windows Cortana is a great source of information. C:\Users\%Username%\AppData\Local\Packages\Microsoft.Windows.Cortana_xxxx\LocalState\ESEDatabase_CortanaCoreInstance\CortanaCoreDb.db contains user locations, reminders etc. Use a πŸ›  SQLite browser to see the contents, or export to cvs and work in Excel.

πŸ›‘οΈ Defence Mechanisms

In this section, I will collect different defence mechanisms, bypass techniques and possible artefacts to look out for.


πŸ“ˆ User Statistics

This is about … .

πŸ”¦ Search History

This is about … .

Legal Acts

This is about … .