IT Forensics – Windows

Forensic analysis of Windows COM artefacts – tracing components and system activities

The Component Object Model (COM) is a key component of Windows. Numerous applications and system components register COM objects, CLSIDs and other entries which, in the context of an IT forensic investigation, can provide relevant clues about installed software, configurations or system changes.

Enquire without obligation

COM artefacts are never assessed in isolation. It is only by correlating them with registry hives, prefetch files, event logs, file system artefacts and other digital traces that a reliable technical assessment can be made.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of COM registrations, CLSIDs, ProgIDs and associated registry artefacts; correlation with other Windows artefacts; and full documentation of all investigation steps.

Typical areas of application

•Malware analysis
•Incident Response
•Investigation of persistence mechanisms
•Software forensics
•Corporate Forensics
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, COM-related registry entries and other artefacts are analysed and technically assessed alongside other digital evidence.

Why are COM artefacts important?

They can provide information on installed components, system changes or misused COM objects, thereby assisting in the reconstruction of a security incident.

Frequently Asked Questions

Which COM artefacts are being investigated?+
These include, amongst other things, CLSIDs, ProgIDs, InProcServer registrations and other COM-related registry entries.
Are COM artefacts conclusive evidence in their own right?+
No. They are always assessed in the context of other digital traces.
Are you working on the original system?+
No. Only a forensic copy or forensic image is analysed.
Are COM artefacts relevant to malware investigations?+
Yes. Certain malicious programmes use COM technologies or leave traces of them behind.

🔗 Related topics

LanCologne – Windows Forensics in Cologne

LanCologne supports you in carrying out legally admissible analyses of Windows COM artefacts and in the objective reconstruction of complex IT forensic cases.

Get in touch now