https://www.mytechnician.tech/labs/ Windows 11 security labs from My Technician: forensic artifacts, event log analysis, persistence, and detection. en-us Sat, 08 Aug 2026 16:39:12 GMT https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/ https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/ Sat, 08 Aug 2026 00:00:00 GMT Windows records that a program ran in at least six separate places, and they do not agree with each other. Here is what each artifact actually proves on Windows 11, and which one to trust. https://www.mytechnician.tech/labs/usb-device-history-windows-11-registry-setupapi/ https://www.mytechnician.tech/labs/usb-device-history-windows-11-registry-setupapi/ Sat, 08 Aug 2026 00:00:00 GMT Windows keeps a permanent record of every USB storage device ever attached, including serial numbers and first-connect times. Here is where it lives on Windows 11 and how to read it. https://www.mytechnician.tech/labs/triage-compromised-windows-11-pc-30-minutes/ https://www.mytechnician.tech/labs/triage-compromised-windows-11-pc-30-minutes/ Sat, 08 Aug 2026 00:00:00 GMT A fast, ordered pass over a Windows 11 machine you think is compromised, using only free tools. What to check, in what sequence, and how to tell a real finding from normal noise. https://www.mytechnician.tech/labs/srum-srudb-dat-windows-11-forensics/ https://www.mytechnician.tech/labs/srum-srudb-dat-windows-11-forensics/ Sat, 08 Aug 2026 00:00:00 GMT SRUDB.dat records how much data each application sent and received, hour by hour, for around 30 days. It is the only standard Windows artifact that ties a program to network volume. https://www.mytechnician.tech/labs/shimcache-vs-amcache-vs-prefetch-execution-evidence/ https://www.mytechnician.tech/labs/shimcache-vs-amcache-vs-prefetch-execution-evidence/ Sat, 08 Aug 2026 00:00:00 GMT Three Windows artifacts get treated as interchangeable evidence that a program ran. Only one of them actually proves it. Here is what each records on Windows 11 and how to read them together. https://www.mytechnician.tech/labs/read-windows-firewall-log-pfirewall-windows-11/ https://www.mytechnician.tech/labs/read-windows-firewall-log-pfirewall-windows-11/ Sat, 08 Aug 2026 00:00:00 GMT Windows Firewall can log every allowed and dropped connection, but the logging is off by default. Here is how to turn it on, read the format, and find outbound traffic that should not be there. https://www.mytechnician.tech/labs/prefetch-files-windows-11-proving-execution/ https://www.mytechnician.tech/labs/prefetch-files-windows-11-proving-execution/ Sat, 08 Aug 2026 00:00:00 GMT A .pf file records how many times a program ran and the last eight times it happened. Here is how to read Prefetch on Windows 11, and the three ways the evidence misleads you. https://www.mytechnician.tech/labs/event-ids-7045-4698-service-scheduled-task-persistence/ https://www.mytechnician.tech/labs/event-ids-7045-4698-service-scheduled-task-persistence/ Sat, 08 Aug 2026 00:00:00 GMT A new service and a new scheduled task are the two most common ways malware survives a reboot on Windows. Both are logged. Here is how to read those events and separate them from normal software installs. https://www.mytechnician.tech/labs/event-id-4624-logon-types-windows/ https://www.mytechnician.tech/labs/event-id-4624-logon-types-windows/ Sat, 08 Aug 2026 00:00:00 GMT Security event 4624 records every successful logon, but the Logon Type field is what makes it useful. Here is what each type means on Windows 11 and which ones should make you look twice. https://www.mytechnician.tech/labs/detect-scheduled-task-persistence-windows-11/ https://www.mytechnician.tech/labs/detect-scheduled-task-persistence-windows-11/ Sat, 08 Aug 2026 00:00:00 GMT How a persistent scheduled task is planted on Windows 11, demonstrated in an isolated lab, and the exact registry keys, XML files, and event IDs it leaves behind for a defender to find. https://www.mytechnician.tech/labs/detect-remote-access-windows-11-rdp-teamviewer-anydesk/ https://www.mytechnician.tech/labs/detect-remote-access-windows-11-rdp-teamviewer-anydesk/ Sat, 08 Aug 2026 00:00:00 GMT RDP, TeamViewer and AnyDesk each leave a different trail on Windows 11. Here are the exact event IDs, log files and registry keys that show who connected, when, and from where. https://www.mytechnician.tech/labs/build-malware-analysis-lab-windows-11-hyper-v/ https://www.mytechnician.tech/labs/build-malware-analysis-lab-windows-11-hyper-v/ Sat, 08 Aug 2026 00:00:00 GMT A safe Windows 11 analysis VM with no route to your network or the internet, using Hyper-V that is already on your machine. No second PC and no paid software required. https://www.mytechnician.tech/labs/amcache-hve-windows-11-forensics/ https://www.mytechnician.tech/labs/amcache-hve-windows-11-forensics/ Sat, 08 Aug 2026 00:00:00 GMT Amcache stores the SHA-1 of executables Windows has encountered — including ones already deleted. Here is how to parse it on Windows 11 and what its entries do and do not prove.