IT Forensics – Windows

Forensic analysis of Windows Error Reporting (WER) – investigating programme crashes and system errors

Windows Error Reporting (WER) generates reports in the event of programme and system errors, which may contain technical information about crashes and error situations. As part of an IT forensic investigation, these artefacts often provide valuable insights into the state of a system, the time at which an error occurred, and the applications involved.

Enquire without obligation

A professional analysis is never carried out in isolation. It is only by correlating the data with event logs, prefetch files, registry artefacts, memory dumps and other digital traces that a robust technical assessment can be made.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Evaluation of WER reports, analysis of crash information, chronological classification of error events, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Incident Response
•Malware and ransomware investigations
•Analysis of programme crashes
•Reconstruction of technical incidents
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, any existing WER artefacts are identified and analysed. This is followed by a comprehensive technical assessment, taking into account other relevant lines of evidence.

Why are WER artefacts important?

They can provide information about programme crashes, system errors and the processes involved. However, meaningful insights can only be gained from a comprehensive analysis of all relevant artefacts.

Frequently Asked Questions

What information do WER reports contain?+
Depending on the data available, this includes, amongst other things, details of processes, errors, modules and the times at which crashes occurred.
Are all crashes logged?+
No. The scope and availability depend on the Windows configuration and the data available.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are WER artefacts alone sufficient for an expert report?+
No. They are always analysed alongside other Windows artefacts.

LanCologne – Windows Forensics in Cologne

Do you require a professional analysis of Windows Error Reporting (WER) or other Windows artefacts? LanCologne can assist you with the forensic preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now