Get Started
← Cyber defence · Mission 10 of 10

Do a digital forensics investigation of your own PC

Windows quietly records almost everything: every USB device ever plugged in, every file you opened and from which drive, every program that ran and how many times, every folder you browsed. Investigators turn those traces into a minute-by-minute timeline. Collect your own PC's evidence with a Velociraptor offline collector, parse it with Eric Zimmerman's free tools, rebuild what happened when, and write it up like a real examiner. Nothing leaves your machine.

150 minAdvancedTools: FreeStep 1 free
Quick evidence with no admin rightsUSB history, browser history and recently opened files from kit scripts and the EZ tools, run on a real Windows 11 laptop
A full triage collection of your PC with a Velociraptor 0.77 offline collector, the free alternative to KAPE
Every artifact parsed with Eric Zimmerman's tools by one kit script: Prefetch, Amcache, LNK, jump lists, ShellBags, registry, event logs and the MFT
  • A timeline built in Timeline Explorer, and the method for working out what happened when from artifacts that agree
  • A cheat sheet of what each artifact proves, and a report template that reads like a professional's
Before you start
  • Windows 10 or 11 and an administrator account (steps 2 and 3 work without one)
  • About 10GB free disk space for the collection and parsed output
  • Python 3.9+ for the browser script (winget install Python.Python.3.12)
  • Helpful first: Threat-hunt your Windows event logs, which covers the event log side in depth
01/07Think like an examiner: the question, copies and notes0 done
STEP 01 of 07~8 min

Think like an examiner: the question, copies and notes

Start with a question, work on copies, and write everything down.

  1. Start with a question, not a tool. 'Was anything plugged into this PC while I was away last weekend?' 'What happened between 7pm and 11pm on the 29th?' 'Did the program I removed ever actually run?' A question tells you which artifacts matter and when you're done.

  2. Work on copiesOpening a file, browsing a folder or even booting the PC changes the very timestamps you want to read. Examiners collect copies first and analyse those. You'll do the same with Velociraptor in step 4.

  3. Write notes as you go, with times and the time zone. Windows stores most artifacts in UTC; Eric Zimmerman's tools output UTC by default; your clock shows local time (BST in summer, which is UTC+1). Mixing them up is the most common beginner mistake.

  4. The kitusb-history.ps1, browser-history.py, run-ez-tools.ps1, artifact-cheatsheet.md and report-template.md.

    TipYour own PC only. Everything here is for a computer you own, or one whose owner has asked you in writing to investigate it.
✓
CheckpointYou've written your investigation question in one sentence at the top of report-template.md.
Stuck? Ask the community