IT Forensics – Windows

Forensic analysis of the Windows Activity Cache – reconstructing user activities

Depending on the version of Windows and the system configuration, the Windows Activity Cache contains information about user activities and their chronological sequence. These artefacts can help to track application usage, document access and other activities on a system.

Enquire without obligation

As part of a professional IT forensic investigation, data from the activity cache is never assessed in isolation. Only by correlating it with timeline artefacts, event logs, registry data, file system traces and other digital evidence is it possible to carry out a reliable technical reconstruction.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of the Windows Activity Cache, chronological reconstruction of user activities, correlation with other Windows artefacts, and full documentation of all investigative steps.

Typical areas of application

•Reconstruction of user activities
•Incident Response
•Malware investigations
•Insider cases
•Corporate Forensics
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, any existing activity cache artefacts are identified, technically analysed and correlated with other digital traces.

Why is the activity cache important?

The Activity Cache can provide additional clues as to the chronological sequence of user activities and thereby assist in reconstructing a digital sequence of events.

Frequently Asked Questions

What information does the Activity Cache contain?+
Depending on the version of Windows and the system configuration, the file may contain information about user activities and the times at which they occurred.
Is this data always available?+
No. The scope and availability depend on the specific system configuration.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Is the Activity Cache alone sufficient for an expert report?+
No. It is always technically assessed in conjunction with other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne helps you carry out a legally admissible analysis of the Windows Activity Cache and objectively reconstruct digital user activities.

Get in touch now