Evids
Star

Evids is a list of known artifacts to check which can give you an insight of user activities.

This was inspired by the GTFOBins project for Windows. Initial data taken from SANS poster - “Evidence of..”.

List of available categories available here. Instruction on how to contribute is available here.

Artifact	Categories
XP Search – ACMRU	Deleted File or File Knowledge
ADS Zone.Identifier	File Download
Amcache.hve	Program Execution
Authentication Events	Account Usage
BAM/DAM	Program Execution
Browser Artifacts	File Download Browser Usage
Browser Cache	Browser Usage
Browser Download Manager	File Download Browser Usage
Browser History	Browser Usage
Browser Search Terms	Network Activity / Physical Location Browser Usage
Cookies	Network Activity / Physical Location Browser Usage
Drive Letter and Volume Name	External Device/USB Usage
Email Attachments	File Download
First/Last Times	External Device/USB Usage
Flash & Super Cookies	Browser Usage
Google Analytics Cookies	Browser Usage
IE\|Edge file://	Deleted File or File Knowledge File/Folder Opening
Jump Lists	Program Execution File/Folder Opening
Key Identification	External Device/USB Usage
Last Login	Account Usage
Last Password Change	Account Usage
Last-Visited MRU	Program Execution Deleted File or File Knowledge File/Folder Opening
Shortcut (LNK) Files	File/Folder Opening External Device/USB Usage
Logon Types	Account Usage
Network History	Network Activity / Physical Location
Office Recent Files	File/Folder Opening
Open/Save MRU	File Download File/Folder Opening
PNP Events	External Device/USB Usage
Prefetch	Program Execution File/Folder Opening
RDP Usage	Account Usage
Recent Files	File/Folder Opening
RecentApps	Program Execution
Recycle Bin (Win7/8/10)	Deleted File or File Knowledge
Recycle Bin (WinXP)	Deleted File or File Knowledge
Services Events	Account Usage
Session Restore	Browser Usage
Shell Bags	File/Folder Opening
Shimcache	Program Execution
Skype History	File Download
System Resource Usage Monitor (SRUM)	Program Execution Network Activity / Physical Location
Success/Fail Logons	Account Usage
Thumbcache	Deleted File or File Knowledge
Thumbs.db	Deleted File or File Knowledge
Timezone	Network Activity / Physical Location
Unique USB (User)	External Device/USB Usage
UserAssist	Program Execution
Volume Serial Number	External Device/USB Usage
Windows 10 Timeline	Program Execution
WLAN Event Logs	Network Activity / Physical Location
WordWheelQuery	Deleted File or File Knowledge
No artifact matches...

Evids Star

Evids
Star