Cluster 10 // MoFu
Forensic Cheat Sheet: Windows & Linux Artifacts Every Responder Should Know
Where to look first: event IDs, registry keys, memory plugins and timeline steps for triage.
Cyber Champion Founder (Founder & Senior Staff Security Engineer )
• Published: October 23, 2026
• Updated: November 3, 2026
• 3 min read
DFIR Forensics Cheatsheet Windows Linux Security+
Forensic Cheat Sheet: Windows & Linux Artifacts Every Responder Should Know
Quick reference for triage. Always work on a forensic image or collected copy, hash evidence first (sha256sum / Get-FileHash), and record every action in your notes.
Order of volatility
CPU registers, cache, running processes, network connections
RAM (acquire with WinPmem, DumpIt or LiME)
Swap / pagefile, temp files
Disk (write-blocked image: dc3dd, FTK Imager)
Remote logs, backups, cloud audit trails
Windows artifacts
Question
Artifact
Location
What ran?
Prefetch
C:\Windows\Prefetch\*.pf
What ran (long-term)?
Amcache, ShimCache
C:\Windows\AppCompat\Programs\Amcache.hve, SYSTEM hive
Who logged in?
Security log 4624/4625/4672
Security.evtx
New service installed?
System 7045, Security 4697
System.evtx
PowerShell activity
4104 script block, 4103 module
Microsoft-Windows-PowerShell/Operational
Persistence
Run keys, scheduled tasks, services, WMI
HKCU/HKLM\...\CurrentVersion\Run, C:\Windows\System32\Tasks
Files opened
Jump Lists, LNK, ShellBags, RecentDocs
%APPDATA%\Microsoft\Windows\Recent
File history of a volume
$MFT, $UsnJrnl, $LogFile
NTFS metadata (parse with MFTECmd)
USB use
USBSTOR, MountedDevices, setupapi.dev.log
SYSTEM hive, C:\Windows\INF
Browser
History, cache, downloads
profile SQLite databases
Program uninstall evidence
Uninstall keys
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Useful event IDs: 4624 logon, 4625 failed logon, 4648 explicit creds, 4672 special privileges, 4688 process creation, 4698 scheduled task created, 4720 user created, 4728/4732 group membership change, 1102 audit log cleared.
Linux artifacts
Question
Artifact
Logins
/var/log/auth.log or /var/log/secure, last, lastb, wtmp, btmp
Commands run
~/.bash_history (easily tampered), auditd execve records
Persistence
crontab -l, /etc/cron.*, systemd units in /etc/systemd/system, ~/.ssh/authorized_keys, /etc/rc.local, shell rc files
Network
ss -tulpn, /proc/net/*, firewall rules
Processes
/proc/<pid>/exe, cmdline, maps; look for (deleted) binaries
File timeline
stat, find / -mtime -2, ext4 journal
Memory forensics (Volatility 3)
vol -f mem.raw windows.info
vol -f mem.raw windows.pslist / windows.psscan / windows.pstree
vol -f mem.raw windows.netscan
vol -f mem.raw windows.cmdline
vol -f mem.raw windows.malfind
vol -f mem.raw windows.dumpfiles --pid <PID>Compare pslist with psscan to find hidden or terminated processes. malfind flags RWX regions that contain code.
Timelining
Combine MFT, event logs, Prefetch and browser history into one super timeline (Plaso: log2timeline.py, then psort.py). Pivot on the first suspicious timestamp, then look 5 minutes either side.
Chain of custody checklist
Who collected it, when, from which system and how
Hash before and after every transfer
Write-blocker or read-only mount used
Storage location and who has had access
Security+ SY0-701 link
This maps to Domain 4 (Security Operations): incident response process (preparation, detection, analysis, containment, eradication, recovery, lessons learned), digital forensics (legal hold, chain of custody, order of volatility) and log review.