IT Forensics – Windows

Forensic analysis of Windows Microsoft Defender for Endpoint (MDE) artefacts – tracing security events

Microsoft Defender for Endpoint (MDE) provides comprehensive security features for detecting and analysing attacks. Depending on the configuration in use, local artefacts, logs and metadata are generated which may provide insights into detected threats, security events and system activities.

Enquire without obligation

As part of a professional IT forensic investigation, MDE artefacts are never assessed in isolation. Only by correlating them with Windows event logs, Sysmon data, registry artefacts, file system traces and other digital evidence is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of local Microsoft Defender for Endpoint artefacts, reconstruction of security-related events, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Incident Response
•Ransomware investigations
•Malware analysis
•Analysis of attack chains
•Corporate Forensics
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, any MDE artefacts are identified, analysed and technically assessed alongside other digital evidence.

Why are MDE artefacts important?

They can provide valuable insights into detected security incidents, endpoint protection responses and chronological sequences. However, their significance only becomes apparent once all relevant artefacts have been analysed as a whole.

Frequently Asked Questions

What sort of information can MDE artefacts contain?+
Depending on the configuration, this may include, amongst other things, alerts regarding detected threats, security incidents and endpoint protection measures.
Are MDE artefacts present on every Windows system?+
No. They are only available if Microsoft Defender for Endpoint has been deployed.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are MDE artefacts alone sufficient for an expert report?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne supports you in carrying out legally admissible analyses of Microsoft Defender for Endpoint and in the objective evaluation of complex IT forensic investigations.

Get in touch now