IT Forensics – Windows
Forensic analysis of Windows COM artefacts – tracing components and system activities
Das Component Object Model (COM) ist ein zentraler Bestandteil von Windows. Zahlreiche Anwendungen und Systemkomponenten registrieren COM-Objekte, CLSIDs und weitere Einträge, die im Rahmen einer IT-forensischen Untersuchung relevante Hinweise auf installierte Software, Konfigurationen oder Systemänderungen liefern können.
COM-Artefakte werden niemals isoliert bewertet. Erst die Korrelation mit Registry-Hives, Prefetch-Dateien, Event Logs, Dateisystemartefakten und weiteren digitalen Spuren ermöglicht eine belastbare technische Einordnung.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.
The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
Analysis of COM registrations, CLSIDs, ProgIDs and associated registry artefacts; correlation with other Windows artefacts; and full documentation of all investigation steps.
Typical areas of application
This is how the analysis works
Once a forensic image has been created, COM-related registry entries and other artefacts are analysed and technically assessed alongside other digital evidence.
Warum sind COM-Artefakte wichtig?
They can provide information on installed components, system changes or misused COM objects, thereby assisting in the reconstruction of a security incident.
Frequently Asked Questions
🔗 Related topics
LanCologne – Windows Forensics in Cologne
LanCologne supports you in carrying out legally admissible analyses of Windows COM artefacts and in the objective reconstruction of complex IT forensic cases.