IT Forensics – Windows

Forensic analysis of Windows Microsoft Store artefacts – Tracing installed apps and updates

The Microsoft Store allows you to install and update a wide range of Windows applications. Depending on the version of Windows and how it is used, this process generates databases, configuration files, logs and other artefacts that may provide information about installed apps, updates and user activities.

Enquire without obligation

As part of a professional IT forensic investigation, Microsoft Store artefacts are never assessed in isolation. Only by correlating them with file system artefacts, registry data, event logs, user profiles and other digital traces is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of Microsoft Store artefacts, reconstruction of installed and updated apps, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Incident Response
•Malware investigations
•Analysis of installed applications
•Corporate Forensics
•Compliance audits
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant artefacts are identified, analysed and technically categorised alongside other digital traces.

Why are Microsoft Store artefacts important?

They can provide information on which applications have been installed, updated or removed, and help to reconstruct the timeline of system changes.

Frequently Asked Questions

What information can be analysed?+
These include, amongst other things, information on installed apps, update processes and configuration data.
Are all installations traceable?+
The scope depends on the version of Windows and the artefacts present.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are these artefacts alone sufficient for an expert report?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne helps you carry out a legally admissible analysis of Microsoft Store artefacts and objectively reconstruct system and user activities.

Get in touch now