ArtiFast Blog

Last Accessed Key

22/10/2021 Friday - Asmaa Elkhatib

All versions of Windows systems include a Registry Editor (regedit.exe). This tool allows users to view the Windows registry and perform various functions within the registry such as creating, modifying and deleting keys, subkeys values and value data. The Last Accessed Key artifact ...

Read More

Sticky Notes

18/10/2021 Monday - Lina Alsoufi

Sticky Notes is a desktop note-taking application that came with Windows 7, Windows 8, and Windows 10. It’s known for its instant launching as it enables its users to quickly and easily take notes on the post-it notes version of Windows ...

Read More

Typed URLs

15/10/2021 Friday - Asmaa Elkhatib

TypedURLs is a Windows Registry key that is similar in concept to TypedPaths key. The key records URLs typed or inserted in the Internet Explorer (IE) address bar. URLs that are completed by the browser’s AutoComplete functionality are not recorded in the key unless the website was ...

Read More

Solving HireMe Challenge with ArtiFast Windows

13/10/2021 Wednesday - Radhwan Alshammari

In this blog post, we will be solving a challenge designed by Cyber Defenders using ArtiFast Windows. In this challenge, a security professional is joining a new company and was assigned a task to demonstrate her technical expertise (full scenario) ...

Read More

Typed Paths

11/10/2021 Monday - Asmaa Elkhatib

TypedPaths is a Windows Registry key that records the last 25 paths typed or inserted into the path bar of File Explorer (previously known as Windows Explorer). The typed paths, however, do not appear instantly within the TypedPaths key. The user has to close the File Explorer window ...

Read More

Windows Calendar

08/10/2021 Friday - Lina Alsoufi

Calendar is a built-in Windows application developed by Microsoft. Calendar helps users in managing their schedules, meetings, reminders, appointments, and different types of events. It also enables the synchronization of calendars using Microsoft Exchange Server, Outlook, Apple's iCloud ...

Read More

Paint MRU

06/10/2021 Wednesday - Asmaa Elkhatib

Windows systems include a number of installed and ready to use applications. Among these applications is the Microsoft Paint utility. The recent files accessed by the user via MS Paint are stored in the Registry within the “Recent File List” subkey beneath the “Paint” key. However, recent files ...

Read More

Outlook

04/10/2021 Monday - Lina Alsoufi

Mailboxes make an essential part of our lives since it is considered one of the most important methods of communication in the 21st century. In accordance, the forensics of mailboxes is a crucial part of digital forensics. Forensic searches are carried out to investigate and find any leads ...

Read More

Run MRU

01/10/2021 Friday - Asmaa Elkhatib

The Run utility on Windows Systems enables the user to directly open an application, folder or document. In Windows 10, the Run utility can be accessed by right-clicking on Start > Run or by using the keyboard shortcut Windows Key + R. As seen in the figure below, the Run utility ...

Read More

UserAssist

29/09/2021 Wednesday - Ummul-Kulthum Wambai

Windows systems have a database where the important operating system and application configurations are maintained. This database is called the Windows Registry, it is made up of keys and values analogous to filesystems’ folders and files respectively. UserAssist is a key in a part ...

Read More

Google Chrome

27/09/2021 Monday - Lina Alsoufi

Chrome is an open-source web browser developed by Google. Chrome Web browser is known for its fast performance, security, and privacy. The web browser is available for desktop (Windows, macOS, Linux, OpenBSD,FreeBSD and Fuchsia) and mobile devices (Android and iOS) ...

Read More

RecentDocs MRU

24/09/2021 Friday - Asmaa Elkhatib

Windows operating systems record and store a mine of information specific to actions taken by a user account. Among the information tracked is the recent files and folders accessed by the user. Information about the files that were recently opened/saved and the folders that were ...

Read More

Thunderbird

21/09/2021 Tuesday - Lina Alsoufi

Mozilla Thunderbird was developed by the Mozilla Foundation as an open-source cross-platform email application that provides personal information management, news client, chat client and RSS feed. Thunderbird was designed to adopt the style of Mozilla's Firefox web browser ...

Read More

Foxit Reader

17/09/2021 Friday - Asmaa Elkhatib

Foxit Reader is a PDF document reader and viewer software similar to Adobe Acrobat Reader, which provides PDF document management solutions. It enables the user to view, edit, comment, sign, print, share, and export PDF files for free with annotations and online storage ...

Read More

AmCache

14/09/2021 Tuesday - Ummul-Kulthum Wambai

AmCache.hve is a Windows system file that is created to store information related to program executions. The artifacts in this file can serve as a huge aid in an investigation, it records the processes recently run on the system and lists the paths of the files executed ...

Read More

Opera

10/09/2021 Friday - Lina Alsoufi

Opera is a multi-platform web browser developed by Opera Software. Opera Web browser is known for its small size, speed and stability. The web browser is available for desktop (Windows, macOS, and Linux) and mobile devices (Android and iOS) ...

Read More

Shellbags

07/09/2021 Tuesday - Asmaa Elkhatib

Microsoft Windows tracks and records user's view settings and preferences while exploring folders. These view settings (size, view mode, position, etc.) of a folder window are stored in Shellbags registry keys. Shellbags keep track of the view settings of a folder window once the folder has been viewed ...

Read More

Logon Banner

03/09/2021 Friday - Ummul-Kulthum Wambai

A logon banner is a legal piece of writing that a Windows system user sees at the point of entry into a device. It is set manually and contains information about the permitted and appropriate usage of a computer system and its access capabilities that a user must acknowledge before logging in ...

Read More

Facebook Messenger Windows Application

31/08/2021 Tuesday - Lina Alsoufi

Facebook Messenger is an Instant Messaging (IM) service, and it ranks second among the most popular social network platforms. With more than one billion daily active users on average, it is a rich platform for investigators ...

Read More

FireFox

27/8/2021 Friday - Asmaa Elkhatib

Firefox is an open-source web browser that was developed by Mozilla. Firefox is known and praised for its security and privacy-concerned approach. The web browser is available for desktop (Windows, macOS and Linux) and for mobile devices (Android and iOS) ...

Read More

ThumbCache

24/08/2021 Tuesday - Ummul-Kulthum Wambai

ThumbCache is a feature in Windows operating systems available starting from Windows Vista, that is used to cache thumbnail images of files for windows explorer view. When you open windows explorer in thumbnail view, the files within the folder are displayed as small images that represent the contents of the files ...

Read More

Adobe Acrobat Reader

17/08/2021 Tuesday - Asmaa Elkhatib

Adobe Acrobat Reader is part of Adobe family. It is a cross-platform application which enables the user to view, comment, sign, print, share, collect and track feedback of PDF files for free. The software offers a variety of other features such as creating, editing, and exporting PDF files; however, it requires the ...

Read More

Solving African Falls Challenge with ArtiFast Windows

13/08/2021 Friday - Radhwan Alshammari

In this blog post, we will be solving a challenge designed by Cyber Defenders using ArtiFast Windows. The purpose of this challenge is to analyze the disk image acquired from the suspect’s laptop to determine whether the person in question was performing illegal activities (scenario) ...

Read More

Investigating Signal with ArtiFast Signal

09/08/2021 Monday - Çağatay Yürekli

Signal is a cross-platform messaging application which enables users to send and receive one-to-one and group messages including texts, voice notes, files, photos, videos, and make voice and video calls. Signal was released initially in July 2014 and has become one of the most popular instant messaging applications ...

Read More

Windows Google Drive

06/08/2021 Friday - Salwa Zahi

Google Drive is a service developed by Google for file storage and synchronization. Launched in April 2012, Google Drive helps users to store files, synchronize files between computers, and exchange files on their servers. Moreover, Google Drive offers offline capabilities a part of the Google Docs Editors office suite ...

Read More

LastVisitedMRU

03/08/2021 Tuesday - Asmaa Elkhatib

LastVisitedMRU is a Windows registry key that tracks the applications used to open or save files that are documented in the OpenSaveMRU key. The key also tracks the location of the last file that was accessed (opened or saved) by that application. This is how "Open"/"Save As" Windows shell dialog box keep track of the ...

Read More

OpenSaveMRU

30/07/2021 Friday - Asmaa Elkhatib

OpenSaveMRU is a Windows registry key that tracks files that have been accessed by any application through the "Open" or "Save As" Windows shell dialog box. This key differs slightly between Windows XP and Windows Vista and beyond (OpenSaveMRU on Windows XP and 2003; OpenSavePidMRU on Vista through Windows 10 systems) ...

Read More

Brave

27/07/2021 Tuesday - Lina Alsoufi

Brave is an open-source web browser developed by Brave Software. Brave web browser is known for its fast performance, security, and privacy. The web browser is available for desktop (Windows and macOS) and mobile devices (Android and iOS) ...

Read More

Solving Injector Challenge with ArtiFast Windows

15/07/2021 Thursday - Radhwan Alshammari

In this blog post, we will be solving another challenge designed by Cyber Defenders using the full version of ArtiFast Windows. In this case, an attacker has compromised an organization’s web server through their website. The purpose of this challenge is to analyze the image provided and specify how the breach occurred and to ...

Read More

Windows Recycle Bin

13/07/2021 Tuesday - Asmaa Elkhatib

Windows Recycle Bin was first introduced with Windows 95 and continued until Windows 10. Recycle bin is a temporary storage for the items that have been deleted by the user. The user then has the option to remove the items permanently or recover them in case they were deleted by mistake ...

Read More

PowerShell

09/07/2021 Friday - Ummul-Kulthum Wambai

PowerShell is an object-oriented framework, which consists of a command line shell and scripting language. The shell comes installed by default on every Windows computer and can be installed on Mac and Linux computers. It enables its users to automate administrative tasks and manage configurations in the Windows environment ...

Read More

Windows 10 Notifications

06/07/2021 Tuesday - Asmaa Elkhatib

Windows notifications were first introduced in Windows 8 and continued with Windows 10. The feature provides real-time notifications of a variety of events, such as email alerts, apps updates, security alerts, reminders and other app specific notifications. Windows notifications are usually displayed at the bottom right side ...

Read More

Windows One Drive

02/07/2021 Friday - Salwa Zahi

OneDrive is a file hosting service that offers cloud storage, file synchronization, personal cloud, and client software. OneDrive brings files together in one place by creating a special folder on the user's computer. The contents of these directories are synchronized to the servers of OneDrive and other computers and systems ...

Read More

UC

29/06/2021 Tuesday - Lina Alsoufi

UC Browser is a web browser developed by mobile internet company UCWeb. UC Browser is known for providing a fast, secure, video streaming, high-speed downloads, and an ad-free browsing experience. It is an easy-to-use and simple web browser. It is available for desktop (Windows and macOS) and mobile devices (Android and iOS) ...

Read More

Zoom

25/06/2021 Friday - Ibrahim Saruhan

Zoom is one of the leading cloud-based video conferencing and messaging software. The video telephony software allows multiple participants to communicate concurrently. Its popularity spiked during the COVID-I9 pandemic period of 2019-2020 by gathering the interest of people on both personal and business levels. It is used by banks, schools ...

Read More

User Accounts

22/06/2021 Tuesday - Ummul-Kulthum Wambai

Windows stores user accounts and security descriptors for users on the local computer in a file called SAM (Security Account Manager). SAM is a part of a system defined database where configuration data is stored and retrieved. Using cryptographic measures, this file can be used to authenticate local and remote users to prevent unauthenticated access to ...

Read More

WhatsApp

18/06/2021 Friday - Asmaa Elkhatib

WhatsApp is a cross-platform application owned by Facebook. The platform supports sending and receiving text and voice messages, photos, documents, videos, and locations. WhatsApp provides all these features along with voice and video calls for one-to-one chats and group chats.

Read More

Skype

15/06/2021 Tuesday - Salwa Zahi

Skype is a software that allows users to communicate with one another and is used by millions of individuals and companies to make free video and voice one-to-one and group calls, send instant messages, and exchange files with others. Skype can be used in laptops, mobile devices, or tablets and available for Microsoft Windows, Apple macOS, and ...

Read More

Windows 10 Timeline

11/06/2021 Friday - Asmaa Elkhatib

Windows 10 Timeline was introduced by Microsoft as part of Windows 10 April 2018 Update (Windows 10 version 1803). This feature enables the users to view their currently running apps and look back at their previous activities such as opened documents, programs, images, videos or visited websites. It also enables the users to synchronize ...

Read More

Windows Update Log

09/06/2021 Wednesday - Salwa Zahi

Windows Update log is a log or record of all notable changes made to a Windows system. Every detail of each update implemented by the Windows Update service is recorded by the Windows System. If anti-malware software is installed, the history of its updates is also recorded. Any third-party software built on the device can also capture ...

Read More

Task Scheduler

07/06/2021 Monday - Ummul-Kulthum Wambai

Task scheduler is a component of Windows, which provides a service that allows the system to launch computer programs or scripts at preset times. It monitors the trigger condition chosen by the user and executes when it is met. The task triggers can be calendar based or event-based, and their actions can include sending emails, starting ...

Read More

Windows Photos

04/06/2021 Friday - Salwa Zahi

Windows Photos is an image organizer, graphic editor, and video editor by Microsoft. In Windows 8, it was originally released as a better alternative for Windows Photo Viewer. It has integrated Microsoft Sway where selected photographs can also be used as a source for generating a Sway project. In Windows Photos, users can also share ...

Read More

Torch Web Browser

02/06/2021 Wednesday - Lina Alsoufi

Torch Browser is a web browser and an Internet suite developed by Torch Media. Torch is known for its media grabber, where it provides users with high-speed audio and video downloading capabilities, its built-in Torrent Manager, player, music, tons of free games, and the social media easy sharing feature. It is available for desktop Windows ...

Read More

Solving Hunter Challenge with ArtiFast Windows

31/05/2021 Monday - Radhwan Alshammari

In this blog post, we will be solving a challenge designed by Cyber Defenders using the full version of ArtiFast Windows. In this case, the SOC team detected an illegal port scanning activity coming from a disgruntled employee's system who might be getting help from an outsider (full scenario). The purpose of this challenge is to ...

Read More

ArtiFast Lite

28/05/2021 Friday

ArtiFast Lite is the free version of ArtiFast. This version of ArtiFast does not require license and it enables users to parse and analyze a subset of Windows artifacts ...

Read More

Box Sync

28/05/2021 Friday - Salwa Zahi

Box Sync is a productivity platform that helps mirror Box-saved data to the user’s desktop. Without using a web browser, the user can access and change the content stored on the Box website via the native file browsing interface. Offline connectivity is required for content that synchronizes with the user’s computer.

Read More

Box

27/05/2021 Thursday - Salwa Zahi

Box is a cloud computing service that offers file sharing, collaboration, and cloud storage. In addition, it allows users to share information with other users and manage content across devices. Box was founded in 2005 and is available in several platforms such as for Windows, macOS, and several mobile platforms.

Read More

Thumbs.db

26/05/2021 Wednesday - Ummul-Kulthum Wambai

Thumbs.db files are hidden Windows system files generated in the same directory of each folder on the system. These files are used to cache the thumbnail images that represent the contents within the folders when Windows Explorer is set to the thumbnails or filmstrip view. This makes it faster to display the thumbnails because they would not have to be ...

Read More

Windows Cortana

24/05/2021 Monday - Asmaa Elkhatib

Cortana is a voice-activated digital personal assistant introduced by Microsoft as part of Windows 10 desktop operating systems. Cortana can be used to perform various tasks such as searching the local files or the web, answering simple queries, sending emails and texts, setting different types of reminders based on time, place, or person, and more.

Read More

Prefetch

21/05/2021 Friday - Salwa Zahi

Prefetch is a Microsoft Windows feature that first appeared in Windows XP. It is a Memory Manager component that can speed up the Windows boot process and reduce the time it takes for programs to start up. It achieves this by storing files required by an application in RAM as soon as the application is launched, thereby reducing disk seeks and consolidating ...

Read More

Edge Chromium Web Browser

19/05/2021 Wednesday - Lina Alsoufi

Microsoft Edge is a cross-platform web browser developed by Microsoft. It is known for its high speed, improved security, reading mode, tracking prevention, lightweight. It is also known for providing an organized and easy environment for its users with the integrated Microsoft 365 and Collections feature. The web browser is available for desktop ...

Read More

Microsoft Edge Web Browser and Application

17/05/2021 Monday - Lina Alsoufi

Microsoft Edge web browser, currently known as Microsoft Edge Legacy, is an EdgeHTML-based browser developed by Microsoft. EdgeHTML is a software browser engine that was first introduced as rendering engine part of Internet Explorer 11. Then, it was used in the project Spartan web browser and was later named Microsoft Edge. Microsoft Edge Windows ...

Read More

iCloud

14/05/2021 Friday - Salwa Zahi

iCloud is an Apple Inc. cloud management and cloud computing application launched in October 2011. iCloud allows users to store, share, and send data, files, and documents among users and devices. iCloud is available for Windows, iOS, and macOS devices. In addition, iCloud wirelessly backs up iOS devices directly to iCloud. By connecting accounts via AirDrop ...

Read More

Clubhouse

12/05/2021 Wednesday - Asmaa Elkhatib

Clubhouse is the new hot social media platform that is gaining a ton of traction. The app was launched in April 2020, however, the app found popularity due to the recent appearances of celebrities and public figures such as Elon Musk. Clubhouse is an audio-only social media app; there are no texts, pictures or videos. Users gather in virtual audio chat “rooms” ...

Read More

Windows Wireless Networks

10/05/2021 Monday - Ummul-Kulthum Wambai

Windows 7/10 stores profiles of wireless networks, to which a system has been connected. ArtiFast can locate and parse this data, extracting information such as the network name and connection time.

Read More

Windows System Resource Usage Monitor (SRUM)

07/05/2021 Friday - Asmaa Elkhatib

The Windows System Resource Usage Monitor (SRUM) was first introduced in Windows 8. SRUM tracks 30 to 60 days of system resource usage, particularly application's resource usage, energy usage, Windows push notifications and network connectivity, and data usage. This feature is enabled by default and configured to start automatically upon system startup ...

Read More

Dropbox

04/05/2021 Tuesday - Salwa Zahi

Dropbox is a file hosting service founded in 2007 that offers cloud storage, file synchronization, personal cloud, and client software. Dropbox brings files together in one place by creating a special folder on the user's computer. The contents of these directories are synchronized to the servers of Dropbox and other computers and systems where Dropbox has ...

Read More

Internet Explorer

30/04/2021 Friday - Lina Alsoufi

Internet Explorer is a web browser developed by Microsoft Corporation. It is one of the most known browsers as it was the default web browser for Windows devices from 1995 till January 2015. The Internet Explorer project was started in 1994 as part of an Internet Jumpstart Kit then over time it has gradually developed till reached its latest version Internet ...

Read More

Windows Services

27/04/2021 Tuesday - Ummul-Kulthum Wambai

Windows Services is a key component of the Windows operating system that allows long-running processes to be created and managed in their own sessions. These services start running in the background usually on system boot without any user interaction and can continue to run long after the user has signed off the system. A broad range of functions are ...

Read More

Microsoft Office

23/04/2021 Friday - Asmaa Elkhatib

Microsoft Office is a set of office/productivity related applications widely used around the world. Microsoft Office includes a variety of applications such as Microsoft Word, Excel, Access and Microsoft PowerPoint. Each application is designed to offer a specific task or service to its users. For example, word processing, managing emails, and creating ...

Read More

VLC Media Player

20/04/2021 Tuesday - Salwa Zahi

VLC Media Player (VideoLAN Client) has been developed by the VideoLAN community as a free and open source, lightweight, cross-platform media player app, and streaming media server. VLC is available for Linux, iOS, iPadOS, Tizen, Windows 10 Mobile, Windows Phone desktop operating systems, and mobile platforms. VLC accepts many types of audio and video ...

Read More

Windows Terminal

06/04/2021 Tuesday - Salwa Zahi

Windows Terminal is a modern terminal program for command line and shell users, such as Command Prompt, PowerShell, and Linux Windows Subsystem (WSL). Multiple windows, panes, support for Unicode and UTF-8 characters, a GPU accelerated text rendering engine and the ability to build your own themes and configure text, colors, backgrounds, and shortcuts ...

Read More

Vivaldi

09/03/2021 Tuesday - Lina Alsoufi

Vivaldi Web Browser is a cross-platform web browser developed by Vivaldi Technologies. It is best known for being fast, private, and secure as it is capable of blocking ads and trackers. What makes Vivaldi unique is that it comes in with many built-in features, and it puts the user ...

Read More

Solving CFREDs Data Leak Challenge with ArtiFast Lite

02/03/2021 Tuesday - Radhwan Alshammari

National Institute of Standards and Technology (NIST) provides DFIR challenges to help people learn about various types of challenges and the techniques that can be used to solve them. This challenge provides the following scenario. It is a data leakage case where we are ...

Read More

Solving CFREDs Data Leak Challenge with ArtiFast Windows

23/02/2021 Tuesday - Radhwan Alshammari

National Institute of Standards and Technology (NIST) provides DFIR challenges to help people learn about various types of challenges and the techniques that can be used to solve them. This challenge provides the following scenario. It is a data leakage case where we are ...

Read More

Discord

16/02/2021 Tuesday - Asmaa Elkhatib

Discord is very popular among gamers for its user-friendly features, high performance and ease of use. It has generated so much praise that even if you are not a "true gamer," you might be familiar with the platform. Although Discord was initially centered around games and gamers ...

Read More

Viber PC

09/02/2021 Tuesday - Salwa Zahi

Viber PC is a Japanese corporation Rakuten's that provides cross-platform voice-over IP (VoIP) and instant messaging (IM) web service. Viber PC allows users to send any kind of message such as text, video, contact info, and audio, and to exchange and share data with other ...

Read More

Solving CFREDs Hacking Case Challenge with ArtiFast Windows

02/02/2021 Tuesday - Ibrahim Saruhan

National Institute of Standards and Technology (NIST) provides DFIR challenges to help people learn about various types of challenges and the techniques that can be used to solve them. This challenge provides the following scenario. This challenge requires we analyze a drive ...

Read More

Outlook Express DBX

26/01/2021 Tuesday - Lina Alsoufi

Microsoft Outlook Express is a discontinued Internet-based email program developed by Microsoft Corporation. Outlook Express was part of Internet Explorer in its earlier versions then later to be available as a standalone software. Outlook Express was intended for home ...

Read More

Solving Lost Flash Drive Challenge with ArtiFast Windows

19/01/2021 Tuesday

In this blog post, we will be solving a challenge designed by info-sec.box using ArtiFast Windows. The purpose of this challenge is to analyze an image acquired from a lost flash drive to find the flag (challenge). Below is the solution to the challenge, solved using ArtiFast ...

Read More

Messenger Plus!

12/01/2021 Tuesday - Salwa Zahi

Messenger Plus! is an add-on for Windows Live Messenger and Skype. It was released in May 2001 and provides instant messaging, custom status tags, event and chat logging, auto replies, and the user’s contacts statistics. Messenger Plus! can be used in laptops, mobile devices ...

Read More

Microsoft Messaging

05/01/2021 Tuesday - Salwa Zahi

Microsoft Messaging is an instant messaging platform in Windows 8, Windows 10, and Windows 10 mobile environments. It provides messaging and voice/video calling services. SMS, MMS, and RCS messaging are all supported on the web edition. SMS messages sent via Skype and billing ...

Read More

Twitter

29/12/2020 Tuesday - Asmaa Elkhatib

Social networking applications are essential in today's world. They bypass physical and social boundaries shaping the way people communicate with each other. Twitter is one of the most popular online social networking apps. It is available for installation on the desktop ...

Read More

IM!

22/12/2020 Tuesday - Salwa Zahi

Messenger Plus! is an add-on for Windows Live Messenger and Skype. It was released in May 2001 and provides instant messaging, custom status tags, event and chat logging, auto replies, and the user’s contacts statistics. Messenger Plus! can be used in laptops, mobile devices ...

Read More