Systems forensics: a complete and practical guide

Informatec Digital » Resources » Systems forensics: a complete and practical guide

Computer forensics and cybersecurity have become a key tool for businesses, law enforcement agencies, and forensic experts. We live glued to our phones, computers, and all kinds of connected devices, so any incident leaves a digital trace that, if properly analyzed, can be crucial in a technical or legal investigation.

Although it may sound like a very advanced discipline today, digital forensics began to take shape in the 1980s with the popularization of personal computers, became professionalized in the 1990s, and it was not until the beginning of the 21st century that countries like the United States began to standardize procedures, especially in the face of the brutal increase in cybercrimes and the decentralization of law enforcement.

What is systems forensics and why is it so important?

When we talk about systems forensics, we are referring to the technical-scientific discipline that locates, preserves, extracts and analyzes digital evidence from any device capable of storing or processing data: computers, mobile phones, tablets, external hard drives, IoT systems, drones, connected vehicles, cloud servers, networks, etc.

The goal is not just to recover files or see "what happened," but to reliably reconstruct the facts related to an incident : which systems were compromised, what technique was used, what information was exfiltrated, who had access and at what time, and all of this in a way that can be defended in court if necessary.

This type of analysis relies on rigorous methods for acquiring and processing electronic evidence to avoid altering its original state. Hence the emphasis on integrity, chain of custody, and admissibility: if evidence is mishandled, contaminated, or not properly documented, it can be rejected by a judge and invalidate all previous work.

As society has moved online, with the rise of cloud computing, remote work, and connected devices , the amount of data generated per person has skyrocketed. This presents a huge challenge for analysts, but also an opportunity: the larger the digital footprint, the greater the chances of accurately reconstructing a cybersecurity incident or a technology crime.

This is why digital forensics is considered an essential branch of scientific policing and modern cybersecurity . It supports criminal and civil investigations, helps determine liability in cases of technology fraud, labor disputes, data breaches, and ransomware attacks , and also serves to improve internal security defenses and policies.

Practical applications of forensic analysis in cybersecurity

In the field of cybersecurity, digital forensics is used to investigate incidents such as intrusions, credential theft, industrial espionage, sabotage, or data breaches . The idea is that, once an incident is detected or suspected, the environment is secured and a controlled process of collecting and examining digital evidence is initiated.

This work takes place in an isolated, controlled, and carefully documented environment , using specialized tools that allow for the examination of disks, memory dumps , system logs, network traffic, and other artifacts without modifying the original. The goal is to answer key questions: how the attacker gained access, what exactly they did, what data they accessed, how long they were inside, and whether any backdoors remain.

In addition to clarifying what happened, cybersecurity forensics is essential for defining or adjusting protection measures : firewall rules, EDR configurations, network segmentation, password policies, user training, etc. Many organizations leverage the findings of an expert analysis to update their ISMS, review their regulatory compliance (for example, with ISO 27001), or strengthen critical controls.

It also has a clearly legal aspect: the findings can be presented in a forensic computer report that can be used as evidence in legal proceedings, whether criminal, civil, labor, or administrative. This report typically includes the methodology used, the evidence reviewed, the results obtained, and technical conclusions explained in a way that is understandable to judges and lawyers.

Moreover, cybersecurity forensics provides an additional benefit: it fuels ethical hacking and penetration testing practices . Understanding how cybercriminals actually attack allows for the design of much more realistic penetration tests and better targets for improving an organization's infrastructure.

Evolution and professional rise of digital forensics

The growth of digital forensics is not only technological, but also professional. More and more companies, law firms, and public bodies require specialized computer forensics services for complex incidents: cryptocurrency fraud, identity theft, hate crimes on social media, espionage among competitors, and so on.

International organizations such as INTERPOL have developed reference digital forensic laboratories , global guidelines for establishing national laboratories, and best practices for handling electronic evidence. They also promote training programs, capacity building, and networks of experts who share knowledge and case studies.

Meanwhile, the demand for qualified professionals is exploding. Estimates such as those from the U.S. Bureau of Labor Statistics point to double-digit growth in computer forensics jobs in the coming years, with profiles that combine in-depth technical knowledge and an understanding of the applicable legal framework.

To meet this need, bootcamps and intensive cybersecurity and ethical hacking programs have emerged , along with technical certifications (CPHE, CSFPC, CSIO, CSCE, among others) and advanced training in information security standards such as ISO 27001. Many cybersecurity companies have teams of accredited experts and their own laboratories for analyzing hardware, software, networks, and applications.

In this context, very specific services also appear, such as business-oriented digital forensics consulting , where a specific incident is analyzed (phishing, data leak, internal fraud, sabotage, etc.), deleted or damaged data is recovered, the company is supported in the legal process and corrective measures are designed to prevent the situation from recurring.

Types of forensic analysis in the technological field

Within the broad umbrella of digital forensics, several specializations are typically distinguished based on the type of media or environment being analyzed. Each has its own specific techniques and tools, although they all share the same philosophy: to reliably preserve, analyze, and present digital evidence.

On one hand, there are traditional digital analyses of desktop and laptop computers , aimed at recovering files, studying user activity, and reconstructing timelines of events. This involves file systems, operating system logs, office applications, web browsers, and so on.

Another important branch is the analysis of mobile devices (smartphones, tablets, PDAs, and similar devices). These devices store a huge volume of sensitive data: instant messaging, emails, geolocation, photographs, banking applications, and more. Mobile forensics tools allow for the extraction and decoding of information even when the user has attempted to delete conversations or format the device, or even recover deleted files from Android.

There is also software analysis , which focuses on investigating application code to determine if it has been stolen, manipulated, or compromised. It is essential in cases of intellectual property, malware analysis, or verifying the integrity of critical applications.

Finally, the analysis of memory and storage stands out , focusing on studying the contents of hard drives, USB drives, SSDs, and RAM itself. This includes recovering deleted data, analyzing encrypted volumes, detecting remnants of resident malware, and identifying data that is never written to disk but remains in memory for a period of time.

Key forensic artifacts in Windows systems

In practical terms, most corporate incidents affect Windows environments. These systems generate a large number of forensic artifacts : small traces of activity that, when properly analyzed, allow investigators to infer what a user or attacker has done on a specific computer.

Digital forensics in Windows focuses on identifying, preserving, and studying these artifacts without compromising their integrity . Although the data is scattered across different areas of the system and some is volatile, much of it can be collected relatively easily and offers information of enormous evidentiary value.

Among the most relevant are event logs, Prefetch files, shortcuts (LNK), the Windows Registry with artifacts such as Shimcache, Amcache and ShellBags, as well as information about connected devices, startup programs and recently opened files.

Analysts combine these artifacts with network data, memory dumps, application logs, and SIEM platforms like Wazuh to reconstruct detailed timelines , test the execution of malicious tools, demonstrate the use of specific accounts, or trace information exfiltration to external devices.

In both criminal and internal investigations, these elements help to link technical actions with people and responsibilities , something fundamental when it comes to disciplinary dismissals, contractual disputes, breaches of policies or judicial procedures in general.

Event Logs and their evidentiary value

Windows event logs are one of the richest sources of information. They store a detailed history of system, security, and application events , recorded in files with the .evtx extension located in C:\Windows\System32\winevt\Logs\.

From a forensic point of view, security logs are of particular interest , where failed login attempts (event 4625), successful logins (event 4624), critical changes in security policies (event 4719) and many other actions related to authentication and access control are recorded.

Analyzing these events allows you to detect intrusion attempts, brute-force attacks, privilege escalations, or after-hours access . It is also very useful for identifying which accounts were used during an incident, which IP addresses connected from, or whether audit parameters were modified to try to cover their tracks.

System and application logs also provide clues: unexpected restarts, service errors, installation of suspicious drivers, security application failures… With tools such as the Windows Event Viewer (eventvwr.msc), Sysinternals tools or PowerShell scripts, the analyst can filter, export and correlate large volumes of information.

In many cases, specific utilities or frameworks such as Plaso (Log2Timeline) are used to convert these records into a unified timeline , which is then reviewed with tools such as Timeline Explorer, facilitating the identification of suspicious patterns and correlation with other artifacts.

Prefetch: trace of executed programs

Windows' Prefetch mechanism was designed to improve system performance, but from a forensic perspective, it's pure gold. Every time an application runs, Windows can create a Prefetch file with the .pf extension in the C:\Windows\Prefetch\ folder.

These files contain data about which executable was launched, from which path, how many times, and at what approximate times . Even if the original program has been deleted from the disk, its trace may still be present in Prefetch, helping to prove that it ran on the system.

Prefetch's behavior has evolved: in versions like Windows XP to Windows 7 it was limited to 128 files; from Windows 8 onwards it is combined with Superfetch (SysMain) and the maximum size is increased, allowing for a richer and more detailed history of applications used.

In practice, analysts use tools such as PECmd or WinPrefetchView to extract and visualize information from these files: executable names, paths, associated timestamps, and related files loaded during execution, and also utilities such as Process Explorer to investigate related processes.

This information can be used to identify malware executions, remote administration tools, lateral movement scripts, or suspicious utilities used by an insider attacker. Furthermore, it can corroborate user reports about which applications they used and when, which is very useful in internal investigations or data breaches.

LNK files: shortcuts that tell almost everything

LNK files, commonly known as Windows shortcuts, are another forensic artifact of enormous interest. Each shortcut stores metadata about the target file or folder : original path, storage device, associated dates, and other properties.

These files are created, for example, on the user's desktop or in the recent documents folder (C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\), allowing the reconstruction of which files have been recently opened and from where.

In forensic environments, LNK files are very useful for detecting data exfiltration to external drives , as they can store details of USB devices, such as serial numbers or drive letters. Even if the target file has been deleted or the USB drive is no longer connected, the shortcut can retain key information.

Tools like LECmd or ShellBagsExplorer allow you to extract and analyze this data in bulk, helping to identify accessed network paths, sensitive file names, and user work habits. PowerShell scripts can also be used to list and sort shortcuts by last modification date.

All of this helps to reconstruct the sequence of the user's actions before, during and after an incident: what documents they opened, whether they copied them to a USB drive, whether they ran programs from an unfamiliar folder, etc., reinforcing or contradicting versions of events in an internal conflict or legal proceeding.

Windows Registry: Configuration, Persistence, and Usage Traces

The Windows Registry is a hierarchical database where the operating system and many applications store settings, lists of recent items, and data about devices . From a forensic perspective, it's a goldmine of information for understanding how a computer behaves and what has happened on it.

Among other things, the Registry contains programs that start automatically with the system , ideal for locating persistent malware or remote administration tools that load at every boot. It also includes keys that collect fingerprints of connected USB devices, helping to track external drives used to copy data.

Another group of relevant artifacts are Shimcache and Amcache . The former allows you to know which applications have run on the system (although not always with an exact time), while the latter provides much more precise details: filename, path, SHA1 hash, and various timestamps related to execution.

Furthermore, ShellBags stored under certain Registry keys allow you to reconstruct which folders the user has navigated in the file explorer, even if those folders have been deleted afterward. This provides a very clear picture of which locations have been visited and can reveal attempts to hide or manipulate data.

To analyze the Registry, tools such as Registry Explorer, RECmd, or RegRipper are used , which automate the extraction of relevant sections and present the information in a readable format for the analyst. Again, these are often combined with other sources to validate findings and strengthen conclusions.

Phases of a well-done computer forensic analysis

Beyond the tools and equipment, what is crucial is following an orderly and methodical process . A disorganized forensic analysis can invalidate evidence, create doubt in a trial, or lead to misinterpretations.

In practice, several stages are usually distinguished. First, an initial study of the digital scene , where the systems involved are identified, the environment is secured to prevent further damage, and the scope of the analysis is decided. This is the time to block unnecessary access, preserve logs, and agree with the organization on how the work will be carried out.

Next comes the identification and cataloging of evidence : an inventory of devices, accounts, services, backups, and any other items that may contain relevant data. Here, it is essential to decide which systems will be forensically imaged and to prioritize them according to the criticality and volatility of the information.

The data acquisition phase involves generating bit-by-bit forensic copies of disks, partitions, memory, or containers, typically using physical write blockers to avoid altering the original. This is the foundation of everything; if this stage is performed incorrectly, the rest of the work may be unacceptable.

Once the data is secured, the actual analysis begins : reviewing files, logs, records, memory dumps, Windows artifacts, and any other relevant sources. Automated tools are combined with manual review, timelines are constructed, and pieces are pieced together until a clear picture of the incident emerges.

The final step is the preparation of the expert report , which details the actions taken, the methodology applied, the evidence reviewed, and the technical conclusions. It must be written precisely, but also in language accessible to non-technical people, because it will often be presented to judges, lawyers, or steering committees.

Best practices for forensic analysis on Windows systems

For a forensic investigation in Windows to be sound, it is not enough to know the artifacts; it is necessary to respect a series of good practices that reduce the probability of errors and guarantee the soundness of the conclusions.

The first step is to obtain a faithful, verifiable, and reproducible forensic image of the analyzed system by calculating and documenting hashes before and after the copy. This allows working on duplicates at all times, leaving the original intact in case independent verification is required.

Another key recommendation is to build detailed timelines that integrate information from Event Logs, Prefetch, Registry, LNK files, ShellBags, etc. Tools like Plaso (Log2Timeline) help create a single chronology, which is then reviewed to identify suspicious correlations between events.

It's also important to prioritize the analysis based on the context of the incident . Not all artifacts are equally relevant in every case: in a ransomware attack, startup programs and encryption activity will be of great interest; in a data breach, the history of USB devices and recent shortcuts will be more important.

Automating repetitive tasks is another key point. Using tools and scripts to collect, filter, and summarize forensic data saves time, reduces human error, and frees up more space for high-level analysis. Even so, no serious report should rely solely on automated results: critical review by the analyst is always necessary.

Finally, it is vital to document each step of the process in an analysis log . Recording which commands are executed, which images are generated, which tools are used and in which versions, as well as any incidents during the procedure, helps maintain a clear chain of custody and allows for the defense of the work in legal or audit settings.

The role of forensic experts and specialized laboratories

This entire technical ecosystem requires professionals with a complex combination of skills. A good cybersecurity expert not only knows how to use tools, but also has a deep understanding of operating systems, networks, hardware, legal regulations, and judicial procedures.

Many cybersecurity companies have set up state-of-the-art forensic research labs , equipped with specialized software for mobile device analysis, data extraction and decoding, network analysis tools, malware analysis platforms, and specific cyber intelligence solutions.

These laboratories offer forensic analysis services on all types of hardware and software : computers, tablets, mobile phones (Windows, Android, iOS), hard drives, USB drives, messaging applications such as WhatsApp, email, databases, web pages, internal networks and more.

In addition to conducting the analysis itself, they prepare comprehensive expert reports that meet procedural requirements and provide support in trials, arbitrations, or out-of-court settlements. Many of these teams hold recognized certifications in information security and ethical hacking, which adds to their technical credibility.

Meanwhile, companies with extensive experience in programming and systems complement their forensic analysis services with penetration testing and preventative consulting . This way, they not only respond to past incidents but also leverage the experience gained to strengthen defenses, train employees, and reduce the future attack surface.

Looking at the discipline as a whole, systems forensics has become an indispensable tool for thoroughly understanding cyberattacks, determining responsibility, recovering information, and improving security . In an environment where cybercrime is rampant and data has become a critical asset, having experts and robust procedures makes all the difference between reacting blindly and making informed, effective, and legally defensible decisions.