IT Forensics – Windows

Forensic analysis of Windows AppCompat artefacts – tracing programme executions and compatibility

Windows stores various pieces of information relating to application compatibility. These artefacts can provide clues about programmes that have been run, compatibility settings and specific system events. In the context of an IT forensic investigation, they are used to technically analyse user and programme activities.

Enquire without obligation

A professional analysis is never carried out in isolation. It is only by correlating the data with Prefetch, Amcache, ShimCache, event logs, registry artefacts and other digital traces that a robust technical assessment can be made.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse AppCompat-related artefacts, evaluate evidence of programme execution and cross-check the results against other Windows artefacts. All stages of the investigation are documented in a transparent manner.

Typical areas of application

•Incident Response
•Malware investigations
•Reconstruction of user activities
•Analysis of suspicious programmes
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant AppCompat artefacts are analysed. This is followed by a technical assessment, carried out in conjunction with other digital evidence.

Why are AppCompat artefacts important?

They can provide valuable insights into programme execution and system configurations. However, their significance only becomes apparent once all relevant digital traces have been analysed in their entirety.

Frequently Asked Questions

What information do AppCompat artefacts provide?+
Depending on the available data, this may include, amongst other things, information on programme execution and compatibility settings.
Are these artefacts always present?+
The scope and availability depend on the version of Windows, the configuration and the data available.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are AppCompat artefacts alone sufficient for an expert report?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of Windows AppCompat artefacts or other Windows components? LanCologne can assist you with the forensic preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now