IT Forensics – Windows
Forensic Analysis of Windows MSIX Packages – Understanding Modern Application Installations
MSIX ist das moderne Paketformat von Microsoft für die Bereitstellung und Aktualisierung von Windows-Anwendungen. Installationen, Aktualisierungen und Deinstallationen hinterlassen verschiedene Artefakte, die Rückschlüsse auf installierte Software und Systemänderungen zulassen können.
Im Rahmen einer professionellen IT-forensischen Untersuchung werden MSIX-Artefakte niemals isoliert bewertet. Erst die Korrelation mit AppX-Artefakten, Microsoft-Store-Daten, Registry-Einträgen, Ereignisprotokollen, Dateisystemartefakten und weiteren digitalen Spuren ermöglicht eine belastbare technische Bewertung.
Why LanCologne?
Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.
The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.
Our services
Analysis of MSIX packages, reconstruction of installation and update processes, correlation with other Windows artefacts, and full documentation of all investigation steps.
Typical areas of application
This is how the analysis works
Once a forensic image has been created, MSIX-related artefacts are identified, analysed and technically categorised alongside other digital evidence.
Warum sind MSIX-Artefakte wichtig?
They enable conclusions to be drawn about modern software installations and when they were installed, thereby complementing the reconstruction of user and system activities.
Frequently Asked Questions
LanCologne – Windows Forensics in Cologne
LanCologne helps you carry out legally admissible analysis of Windows MSIX packages and objectively reconstruct digital system changes.