IT Forensics – Windows

Forensic Analysis of Windows MSIX Packages – Understanding Modern Application Installations

MSIX is Microsoft’s modern package format for deploying and updating Windows applications. Installations, updates and uninstallations leave behind various artefacts that may provide information about installed software and system changes.

Enquire without obligation

As part of a professional IT forensic investigation, MSIX artefacts are never assessed in isolation. Only by correlating them with AppX artefacts, Microsoft Store data, registry entries, event logs, file system artefacts and other digital traces is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of MSIX packages, reconstruction of installation and update processes, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Incident Response
•Malware investigations
•Software forensics
•Corporate Forensics
•Compliance audits
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, MSIX-related artefacts are identified, analysed and technically categorised alongside other digital evidence.

Why are MSIX artefacts important?

They enable conclusions to be drawn about modern software installations and when they were installed, thereby complementing the reconstruction of user and system activities.

Frequently Asked Questions

What is the difference between AppX and MSIX?+
MSIX is a further development of the AppX format and is used for modern Windows applications.
Can evidence of previous installations be provided?+
Depending on the artefacts present, there may be evidence of previous installations or updates.
Is the original system being examined?+
No. Only a forensic copy or a forensic image is analysed.
Are MSIX artefacts sufficient on their own?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne helps you carry out legally admissible analysis of Windows MSIX packages and objectively reconstruct digital system changes.

Get in touch now