06/18/2025
🕵️ Windows Forensic Commands: Investigate, Analyze & Respond 🔍💻
When a security incident occurs on a Windows system, knowing which commands to run can make the difference between guessing and solid digital forensics 🧠⚖️.
This guide covers essential Windows forensic commands for triage, evidence collection, and investigation — all from the command line and PowerShell.
🧰 Top Forensic Commands:
📁 File System & Timeline
dir /s /b /a:-d C:\Users\USERNAME\Desktop
dir /T:C /T:A /T:W
🧠 Process & Memory Inspection
tasklist
tasklist /v
wmic process list brief
📜 Network Connections
netstat -ano
ipconfig /displaydns
🔍 User & Logon Information
query user
whoami /all
net user USERNAME
🧾 Event Logs (PowerShell)
Get-WinEvent -LogName Security -MaxEvents 10
Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4624}
📂 Prefetch & Shimcache (for ex*****on evidence)
→ Use tools like WinPrefetchView, AppCompatCacheParser
🛡️ Pro Tip:
Always collect volatile data first, ensure chain of custody, and preserve original evidence with imaging tools where possible 📦🔒.
Disclaimer: This content is for educational and awareness purposes only. Always conduct forensic analysis in authorized and ethical contexts.
