IT Forensics – Windows
Forensic analysis of Windows Microsoft Store artefacts – Tracing installed apps and updates
Der Microsoft Store ermöglicht die Installation und Aktualisierung zahlreicher Windows-Anwendungen. Abhängig von Windows-Version und Nutzung entstehen dabei Datenbanken, Konfigurationsdateien, Protokolle und weitere Artefakte, die Hinweise auf installierte Apps, Aktualisierungen und Benutzeraktivitäten liefern können.
Im Rahmen einer professionellen IT-forensischen Untersuchung werden Microsoft-Store-Artefakte niemals isoliert bewertet. Erst die Korrelation mit Dateisystemartefakten, Registry-Daten, Ereignisprotokollen, Benutzerprofilen und weiteren digitalen Spuren ermöglicht eine belastbare technische Bewertung.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.
The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
Analysis of Microsoft Store artefacts, reconstruction of installed and updated apps, correlation with other Windows artefacts, and full documentation of all investigation steps.
Typical areas of application
This is how the analysis works
Once a forensic image has been created, the relevant artefacts are identified, analysed and technically categorised alongside other digital traces.
Warum sind Microsoft-Store-Artefakte wichtig?
They can provide information on which applications have been installed, updated or removed, and help to reconstruct the timeline of system changes.
Frequently Asked Questions
🔗 Related topics
LanCologne – Windows Forensics in Cologne
LanCologne helps you carry out a legally admissible analysis of Microsoft Store artefacts and objectively reconstruct system and user activities.