Computer and disk forensics

01Scope

Program execution and user activity on Windows (Prefetch, Amcache, ShimCache, UserAssist, BAM, SRUM, Jump Lists, LNK)
File system metadata and journals (NTFS $MFT, $UsnJrnl, $LogFile; FAT and exFAT entries; ext4 inodes)
Deleted, renamed and moved files; Recycle Bin; Volume Shadow Copies
Removable device history and what was copied to it
Accounts, logons and privilege use from the Security log and registry hives
macOS unified log, FSEvents, quarantine and launch items; Linux authentication logs, journal and shell history

Was this program run on this computer, by which account, and when?
Was this document opened, edited, printed or copied to a USB device?
Which removable devices were connected, when, and what volume labels did they carry?
Were files deleted or wiped shortly before the device was handed over?
Was the system clock changed, and do file times contradict each other?
Who logged on, from where, and with what level of privilege?

Source	What it yields	Note
Full disk image (E01, AFF4 or raw) of each internal drive	Every artifact below, deleted data in unallocated space, shadow copies	Hash of the source and of the image must match and be recorded before examination.
Registry hives (SYSTEM, SOFTWARE, SAM, NTUSER.DAT, UsrClass.dat, Amcache.hve)	Time zone, installed software, USB devices, user activity, accounts	Transaction logs (.LOG1/.LOG2) must be applied for a current view.
Event logs (Security, System, Application, operational channels)	Logons, service installs, task creation, log clearing, power events	Audit policy decides what exists. Absence of an event is not evidence of absence.
NTFS metadata files ($MFT, $UsnJrnl:$J, $LogFile, $I30 indexes)	Creation, modification, rename, move and delete history with 100 ns time stamps	$STANDARD_INFORMATION times can be altered by user-mode tools; compare with $FILE_NAME.
Memory image, hibernation file, page file	Running processes, network connections, decrypted data, recently typed text	Only if captured before shutdown or still present on disk; see the memory forensics area.

Acquire and verify
Image the drive through a write blocker or a validated software method, compute the acquisition hash, verify the image and record tool, version, operator and time in the acquisition record.
Establish the system's frame of reference
Read the time zone, DST setting, OS version, install date, user accounts and last shutdown from the registry before interpreting any timestamp.
Answer each question with at least two independent artifacts
Execution: Prefetch plus Amcache or BAM plus event 4688 where auditing allows. File access: LNK plus Jump List plus RecentDocs. USB: USBSTOR plus setupapi.dev.log plus Windows Portable Devices plus LNK volume serial.
Build the timeline in UTC
Normalise every time to UTC with its original encoding and resolution noted. Keep the artifact and the field name next to each event so another examiner can go back to the byte.
Test the alternative explanations
Automatic updates, antivirus scans, indexing services and backup software open and create files too. Before attributing an action to a person, show that the account was interactively logged on and that the pattern matches human activity.

The library records behind this area:

Prefetch proves execution but a hash-named file may belong to a different copy of the same executable; check the path inside the file.
ShimCache and Amcache record presence and metadata, not proof that the program ran at that time.
A file's 'created' time on NTFS can be older than its 'modified' time after a copy; this is normal, not tampering.
SSD TRIM and wear levelling make recovery of deleted content unreliable; absence of carved data proves nothing.
Logon events on a domain-joined machine are split between the workstation and the domain controller.

Source device identifiers, image format, acquisition and verification hashes and the tool versions used.
The system time zone and the basis on which each timestamp was converted to UTC.
For each finding, the artifacts that support it, the artifacts that were checked and did not contradict it, and what could not be determined.
A clear line between 'the account X did' and 'the person Y did'; the second requires evidence beyond the device.

Was the examination done on a verified image, and do the acquisition and verification hashes match?
Which time zone was assumed, and how was it established from the device itself?
Which second artifact corroborates each execution or file-access finding?
Was the possibility of automated activity (updates, antivirus, backup) tested and how?
What does the report say could not be determined, and why?