Microsoft Windows is one of the most common operating systems found on machines during forensic analysis. This has led to a large effort in the community over the past two decades to develop, share, and document artifacts deposited by this operating system for use in forensic casework.
In this chapter, we continue to look at various Windows artifacts and how to process them using Python. We will leverage the framework we developed in Chapter 8, Working with Forensic Evidence Container Recipes to process these artifacts directly from forensic acquisitions. We'll use various libyal libraries to handle the underlying processing of various files, including pyevt, pyevtx, pymsiecf, pyvshadow, and pyesedb. We'll also explore how to process prefetch files using struct and a file format table of offsets and data types of interest. Here's what we'll learn...
