IT Forensics – Windows

Forensic analysis of the Windows Device Metadata Cache – evidence of detected hardware

Windows stores metadata for detected hardware devices in what is known as the Device Metadata Cache. Depending on the device type and version of Windows, information may be stored there that allows conclusions to be drawn about connected hardware and how it is integrated.

Enquire without obligation

In the context of a professional IT forensic investigation, these artefacts are never considered in isolation. Only by correlating them with USB artefacts, SetupAPI logs, MountPoints2, registry data and other digital traces is it possible to arrive at a reliable technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of the Device Metadata Cache, identification of detected devices, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•USB forensics
•Examination of external data storage media
•Incident Response
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant cache files and associated artefacts are analysed and technically correlated with other digital traces.

Why is the Device Metadata Cache important?

It can provide additional information about previously identified hardware, thereby helping to reconstruct a system’s device history.

Frequently Asked Questions

Which devices can be tracked?+
Depending on the system, these may include USB devices, printers, cameras or other supported hardware.
Is the cache alone sufficient as evidence?+
No. It is always assessed in conjunction with other forensic artefacts.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Is the Device Metadata Cache relevant in a court of law?+
It can serve as supplementary evidence within a comprehensive IT forensic investigation.

LanCologne – Windows Forensics in Cologne

LanCologne assists you in carrying out a legally admissible analysis of the Windows Device Metadata Cache and the objective reconstruction of connected hardware.

Get in touch now