Tools, Systems and Programs · Topic 3 of 6

Windows, Linux and macOS Artifact Tools

Learn tools for live collection, Windows memory and registry, browser artifacts, ShellBags, LNK files, Linux and APFS analysis, Spotlight and macOS tools.

5 min

In a nutshell

Collect volatile data first, from trusted tools on external media.
ShellBags are in NTUSER.DAT and UsrClass.dat. LNK files are in the Recent folder.
Browser data is SQLite: History (Chrome), places.sqlite (Firefox).

What it is

Each operating system leaves its own artifacts and each has tools that parse them. This page maps the common artifacts to the right tool: live data, registry and memory, browsers, user activity traces on Windows, then Linux and macOS.

The exam asks where an artifact is stored and which tool reads it.

How it works

Collecting volatile and non volatile data

Follow the order of volatility: memory, network state, processes, then disk.

Platform	Volatile data	Tools and commands
Windows	Processes, connections, logged on users, DNS cache	Sysinternals PsList and PsLoggedOn, netstat -ano, ipconfig /displaydns
Linux	Processes, sockets, open files, logged on users	ps, ss or netstat, lsof, who, last
Both	Triage collection of artifacts	KAPE, Velociraptor, FTK Imager

Non volatile data includes registry hives, event logs, prefetch files, user profiles and logs under /var/log. Collect with a trusted set of tools from external media, and record every command and its time.

Windows memory and registry analysis

Registry hives are in Windows\System32\config (SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT) and in each user's NTUSER.DAT and UsrClass.dat. Tools: Registry Explorer, RegRipper, AccessData Registry Viewer.

Memory analysis uses Volatility. Typical plugins in Volatility 3: windows.pslist.PsList, windows.netscan.NetScan, windows.malfind.Malfind and windows.cmdline.CmdLine.

python3 vol.py -f memory.raw windows.pslist.PsList

Web browser artifacts

Browser	Location and format
Chrome	%LOCALAPPDATA%\Google\Chrome\User Data\Default: History, Cookies (under Network in recent versions) and cache, mostly SQLite databases
Edge	%LOCALAPPDATA%\Microsoft\Edge\User Data\Default, same structure
Firefox	%APPDATA%\Mozilla\Firefox\Profiles\name: places.sqlite (history), cookies.sqlite

Chrome stores time as microseconds since 1601-01-01, Firefox as microseconds since 1970-01-01. Tools: BrowsingHistoryView, ChromeCacheView, Hindsight, DB Browser for SQLite and commercial suites such as Magnet AXIOM.

Private browsing and browser artifact recovery

Private mode avoids writing history, cookies and cache to disk when the session ends. Traces can still exist elsewhere: RAM and pagefile.sys, hiberfil.sys, the DNS cache, prefetch entries, registry entries, thumbnails, downloaded files, network logs and proxy records. Recovery of deleted SQLite records is possible from free pages and write ahead logs, with tools that parse them.

Windows files, metadata, ShellBags, LNK and Jump Lists

Artifact	Location	Shows
ShellBags	NTUSER.DAT and UsrClass.dat (BagMRU and Bags keys)	Folders a user browsed, even later deleted or on removable media
LNK shortcut files	%APPDATA%\Microsoft\Windows\Recent	Target path, timestamps and volume details of opened files
Jump Lists	Recent\AutomaticDestinations and CustomDestinations	Recent files per application
Prefetch	Windows\Prefetch	Program execution and run counts

Tools by Eric Zimmerman: ShellBags Explorer, LECmd (LNK), JLECmd and JumpList Explorer (Jump Lists), MFTECmd (MFT) and PECmd (prefetch). ExifTool reads file metadata.

Linux file system analysis tools

The Sleuth Kit and Autopsy read ext2, ext3 and ext4. Other tools: debugfs, extundelete, ext4magic, and commands such as stat and find. Key paths are /var/log (syslog, auth.log or secure), ~/.bash_history, /etc/passwd and /etc/shadow, crontabs and /tmp.

stat suspicious.sh
find / -mtime -2 -type f

Linux memory forensics

Acquire with LiME (a kernel module) or Microsoft's AVML. Analyze with Volatility using symbol tables that match the kernel. Volatility 3 plugins include linux.pslist.PsList, linux.bash.Bash and linux.lsmod.Lsmod.

APFS analysis

APFS has containers holding volumes that share space, with snapshots, clones and copy on write. Snapshots keep earlier states of files. Parsers such as apfs-fuse and commercial tools read them, but support in general tools varies, so confirm APFS support in the version you use.

Spotlight metadata

Spotlight indexes metadata in a store under the volume's .Spotlight-V100 folder. Live, mdls shows a file's attributes and mdfind searches.

mdls -name kMDItemWhereFroms -name kMDItemLastUsedDate report.pdf

Attributes such as kMDItemWhereFroms (download source) and kMDItemLastUsedDate help show origin and use. Offline, open source Spotlight store parsers read the database.

macOS forensic tools

Tools: BlackLight, Magnet AXIOM, MacQuisition for acquisition, mac_apt (open source artifact parser), diskutil and hdiutil for images, and plutil for property lists.

A worked example

A suspect used a private window to read a competitor's site. The browser history is empty, but a memory dump shows the domain in a process, and the DNS cache and a prefetch file show the browser ran at that time.

The examiner correlates these sources on a timeline and reports that private mode left no history but did leave other traces.

How the exam asks about this

"Which registry data shows folders a user browsed?" → ShellBags.
"Which file extension holds Chrome browsing history?" → It is an SQLite database named History.
"Which tool acquires Linux memory?" → LiME.

What to remember for the exam

Collect volatile data first, from trusted tools on external media.
ShellBags are in NTUSER.DAT and UsrClass.dat. LNK files are in the Recent folder.
Browser data is SQLite: History (Chrome), places.sqlite (Firefox).
Private browsing still leaves memory, DNS and pagefile traces.
LiME acquires Linux memory. Volatility analyzes it.

Watch out

Using the suspect system's own commands can be misleading if it is compromised. Use trusted binaries from external media.

Common mistakes

Treating empty history as no activity. Private mode and clearing only hide the normal store.

Mixing browser time formats. Chrome and Firefox use different epochs.

Assuming every tool reads APFS. Support varies by tool and version.

Check yourself

Where are LNK files stored for recently opened files?
In the user's Recent folder under %APPDATA%\Microsoft\Windows.
Which Volatility 3 plugin lists processes on Windows?
windows.pslist.PsList.
Which macOS command shows Spotlight metadata of a file?
mdls.

Topic 3 of 6 in Tools, Systems and Programs

Test yourself on Tools, Systems and Programs

The full EC-Council 312-49 question bank has 900 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.