Windows Forensics Deep Dive: The 15 Directories Every SOC Analyst Must Master + Video

Introduction:

In the high-stakes world of Security Operations Centers (SOC), the difference between a contained incident and a full-blown data breach often comes down to knowing exactly where to look. While next-gen SIEM tools and EDR solutions provide alerts, they are only as effective as the analyst interpreting them. Mastery of the Windows filesystem is a fundamental, non-negotiable skill for effective threat hunting, digital forensics, and incident response. This article moves beyond simple tool operation, providing a granular, path-by-path guide to the critical Windows directories that reveal adversary tactics, techniques, and procedures (TTPs).

Learning Objectives:

• Identify and analyze critical Windows directories for credential access, persistence, and system compromise.
• Utilize native Windows and Linux command-line tools to manually investigate these forensic artifacts.
• Differentiate between benign system activity and malicious indicators within key files like Prefetch, Amcache, and Event Logs.
• Construct a basic forensic timeline by correlating data from multiple system directories.

You Should Know:

1. The Vaults: Credential Repositories (SAM & SECURITY)

Attackers are consistently after credentials. The Security Account Manager (SAM) and SECURITY files are prime targets. The SAM file stores locally hashed user passwords, while the SECURITY file holds system security policies and cached domain credentials.

Step‑by‑step guide: While these files are locked by the operating system while running, they can be accessed offline or via Volume Shadow Copies.
Linux (Offline Analysis): If you have a disk image, mount it and navigate to the config directory.

 Navigate to the mounted Windows partition
cd /mnt/windows/Windows/System32/config/
 Use 'samdump2' or 'secretsdump.py' to extract hashes
samdump2 SYSTEM SAM -o output_hashes.txt
 Or using Impacket
impacket-secretsdump -sam SAM -system SYSTEM LOCAL

Windows (Live Response): Use a tool like `reg.exe` to save a copy of the registry hives (requires elevated privileges).

 Save the SAM hive to a file for analysis
reg save HKLM\SAM C:\DFIR\SAM.hive
reg save HKLM\SYSTEM C:\DFIR\SYSTEM.hive
reg save HKLM\SECURITY C:\DFIR\SECURITY.hive

Analyzing the extracted hashes with a tool like `John the Ripper` can reveal weak passwords, but immediate identification of well-known compromised hashes is key for threat hunting.

2. The Black Boxes: Windows Event Logs (winevt)

The `C:\Windows\System32\winevt\Logs` directory is the definitive source of truth for system activity. Every successful logon, service install, and application error is recorded here. SOC analysts must be fluent in navigating these logs to find evidence of malicious activity, such as logon type 3 for network logons or event ID 4688 for process creation.

Step‑by‑step guide: Using PowerShell to hunt for suspicious logon events.

 Check for multiple failed logon events (Event ID 4625) which may indicate a brute-force attack
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4625; StartTime=(Get-Date).AddHours(-24)} | 
Select-Object TimeCreated, Message | 
Format-List

Search for successful logons from unexpected hours
Get-WinEvent -LogName Security | Where-Object { $<em>.Id -eq 4624 -and $</em>.TimeCreated.Hour -lt 6 } | 
Select-Object TimeCreated, @{name='User';expression={$_.Properties[bash].Value}}

For deeper analysis, the `wevtutil` command can be used to export logs for offline review in tools like Event Log Explorer. For instance, `wevtutil epl Security C:\temp\security_export.evtx` will create a portable copy.

3. The Execution Trail: Prefetch & Amcache

Knowing what ran on a system is the cornerstone of malware analysis. The Prefetch folder (C:\Windows\Prefetch) contains `.pf` files that list the files loaded by an executable. Amcache (C:\Windows\AppCompat\Programs\Amcache.hve) is a more robust database of executed applications, including their full paths, hashes, and compilation timestamps.

Step‑by‑step guide: Analyzing Prefetch for evidence of a known malicious tool like Mimikatz.
Manual Review: Navigate to C:\Windows\Prefetch. Sort by ‘Date modified’. Look for recently executed, unfamiliar executables. The presence of `mimikatz.exe-xxxxxxxx.pf` is a high-fidelity alert.

Command Line (PowerShell): Hunt for specific binaries.

 List all Prefetch files for a specific executable
$targetExe = "mimikatz"
Get-ChildItem -Path C:\Windows\Prefetch -Filter "$targetExe.pf" | 
Select-Object Name, CreationTime, LastWriteTime

Parse Amcache using a module (requires administrator)
 This is a conceptual snippet using the Parse-Amcache function from PowerForensics
 Get-ForensicAmcache | Where-Object {$_.Path -like "mimikatz"}

Understanding the last run time from a Prefetch file can help determine when an attacker first executed their tools, providing a starting point for timeline analysis.

4. The Persistence Playground: Startup Locations

Adversaries love to maintain access. The most straightforward way is to ensure their malware runs every time the machine boots. The two primary Startup directories are user-specific and system-wide. Malicious scripts, backdoors, or recon tools placed here guarantee re-execution.

Step‑by‑step guide: Checking for persistence mechanisms.

Check Current User Startup:

Open File Explorer and paste: shell:startup. This opens C:\Users\

\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup</code>.

<h2 style="color: yellow;"> Check All Users Startup:</h2>

<h2 style="color: yellow;">Paste: `shell:common startup`. This opens `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup`.</h2>

<h2 style="color: yellow;"> PowerShell for Remote Audit:</h2>

[bash]
 Check Startup directories on a remote machine
$computer = "TARGET-PC"
Invoke-Command -ComputerName $computer -ScriptBlock {
Get-ChildItem -Path "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
Get-ChildItem -Path "C:\Users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
}

reg query HKU\OfflineUser\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKU\OfflineUser\Software\Microsoft\Windows\CurrentVersion\RunOnce

reg unload HKU\OfflineUser