IT Forensics – Windows

Forensic analysis of Windows Credential Manager – Tracing stored login credentials

The Windows Credential Manager is used to manage stored login credentials for local applications, network shares and various Microsoft services. As part of an IT forensic investigation, the associated artefacts can provide clues about stored login details, services used and authentication processes.

Enquire without obligation

A professional analysis is never carried out in isolation. Only by correlating the findings with registry artefacts, user profiles, event logs, the SYSTEM and SECURITY hives, and other digital traces is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse Credential Manager artefacts, assess stored credentials and correlate the results with other Windows artefacts. All stages of the investigation are documented in a transparent manner.

Typical areas of application

•Incident Response
•Investigation into unauthorised access
•Reconstruction of user activities
•Analysis of compromised systems
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, all relevant artefacts from the Credential Manager are analysed and then technically assessed alongside other digital traces.

Why are credential manager artefacts important?

They can provide clues about stored login credentials and how they are used. However, their significance only becomes apparent once all relevant digital traces have been analysed as a whole.

Frequently Asked Questions

What information can be analysed?+
Depending on the data available, this may include, amongst other things, stored login credentials and associated system artefacts.
Are passwords always read out?+
No. The information available depends on the data on hand and the scope of the investigation.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are these artefacts alone sufficient for an expert report?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you require a professional analysis of the Windows Credential Manager or other Windows artefacts? LanCologne can assist you with the forensic-grade preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now