IT Forensics – Windows

Forensic analysis of Windows antivirus and security software – technical assessment of security incidents

In addition to Microsoft Defender, security solutions from various vendors are frequently used on Windows systems. Depending on the product, these generate logs, quarantine information, configuration files and other artefacts that can provide indications of detected threats, file scans and security events.

Enquire without obligation

In the context of a professional IT forensic investigation, these artefacts are never considered in isolation. Only by correlating them with event logs, file system artefacts, registry data, Sysmon logs and other digital traces is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of logs, quarantine areas and configuration data from installed security solutions, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Incident Response
•Malware and ransomware investigations
•Security incidents
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, existing security artefacts are identified, analysed and technically categorised alongside other digital traces.

Why are security artefacts important?

You can document which threats have been detected, what measures have been taken and which security-related events have been logged on the system.

Frequently Asked Questions

Which security solutions can be examined?+
In principle, all locally installed products, provided that their artefacts are present on the system.
Is this data always available?+
No. The scope and content depend on the product used and its configuration.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are security artefacts alone sufficient for an expert report?+
No. They are always assessed alongside other digital evidence.

🔗 Related topics

LanCologne – Windows Forensics in Cologne

LanCologne supports you in carrying out legally admissible analyses of security artefacts and the objective assessment of complex IT forensic incidents.

Get in touch now