Windows 11 Labs
Building the isolated Windows environment the rest of these labs assume, using free tools and no separate hardware.
- Windows 11 Forensic Artifacts: Where Evidence of Program Execution Lives
Windows records that a program ran in at least six separate places, and they do not agree with each other. Here is what each artifact actually proves on Windows 11, and which one to trust.
Forensic artifact · Intermediate · T1057
- USB Device History on Windows 11: What the Registry Proves
Windows keeps a permanent record of every USB storage device ever attached, including serial numbers and first-connect times. Here is where it lives on Windows 11 and how to read it.
Forensic artifact · Beginner · T1052.001
- Triage a Suspected-Compromised Windows 11 PC in 30 Minutes
A fast, ordered pass over a Windows 11 machine you think is compromised, using only free tools. What to check, in what sequence, and how to tell a real finding from normal noise.
Attack and detection · Beginner · T1057, T1543
- SRUM on Windows 11: Reconstructing App, Network and Power Use
SRUDB.dat records how much data each application sent and received, hour by hour, for around 30 days. It is the only standard Windows artifact that ties a program to network volume.
Forensic artifact · Intermediate · T1020
- Prefetch Files on Windows 11: Proving a Program Ran, and When
A .pf file records how many times a program ran and the last eight times it happened. Here is how to read Prefetch on Windows 11, and the three ways the evidence misleads you.
Forensic artifact · Beginner · T1057
- Scheduled Task Persistence on Windows 11: The Attack and Its Artifacts
How a persistent scheduled task is planted on Windows 11, demonstrated in an isolated lab, and the exact registry keys, XML files, and event IDs it leaves behind for a defender to find.
Attack and detection · Intermediate · T1053.005
- Build an Isolated Malware Analysis Lab on Windows 11 with Hyper-V
A safe Windows 11 analysis VM with no route to your network or the internet, using Hyper-V that is already on your machine. No second PC and no paid software required.
Lab setup · Beginner
- Amcache.hve on Windows 11: What It Records and How to Read It
Amcache stores the SHA-1 of executables Windows has encountered — including ones already deleted. Here is how to parse it on Windows 11 and what its entries do and do not prove.
Forensic artifact · Intermediate · T1057