IT Forensics – Windows

Forensic analysis of Windows Defender artefacts – tracing security events

Microsoft Defender is an integral part of modern Windows systems and, depending on the configuration, logs security-related events such as malware detections, scans and protective measures. As part of an IT forensic investigation, these artefacts can provide important clues about attacks, malware or the system’s responses.

Enquire without obligation

A professional analysis is never carried out in isolation. Only by correlating data with event logs, Prefetch, Amcache, registry artefacts, PowerShell, WMI and other digital traces is it possible to arrive at a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse Defender logs, detections, quarantine information and other security-related artefacts. The results are correlated with additional Windows artefacts and fully documented.

Typical areas of application

•Incident Response
•Malware and ransomware investigations
•Analysis of suspicious systems
•Reconstruction of security incidents
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant Defender artefacts are analysed. The results are then correlated with other digital traces and technically assessed.

Why are Defender artefacts important?

They can provide information on detected threats, protective measures and scanning processes. However, their significance only becomes apparent once all relevant digital traces have been analysed in their entirety.

Frequently Asked Questions

What information can Defender artefacts contain?+
Depending on the system, this may include, amongst other things, malware detections, scan logs and quarantine information.
Are Defender logs always complete?+
No. The scope and availability depend on the configuration and the available data.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are Defender artefacts alone sufficient for an expert assessment?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you require a professional analysis of Windows Defender artefacts or other Windows components? LanCologne can assist you with the forensic preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now