IT Forensics – Windows

Forensic Analysis of Windows Sandbox Artifacts – Tracing Temporary Execution Environments

Windows Sandbox allows applications to be run in isolation within a temporary virtual environment. Although the environment is reset once it is closed, traces of its use may still remain on the host system and in associated artefacts.

Enquire without obligation

As part of a professional IT forensic investigation, sandbox artefacts are never assessed in isolation. Only by correlating them with event logs, file system artefacts, registry data, Hyper-V components and other digital traces is it possible to carry out a robust technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of Windows Sandbox configurations, evaluation of relevant host artefacts, correlation with other Windows artefacts, and comprehensive documentation of all investigation steps.

Typical areas of application

•Incident Response
•Malware analysis
•Investigation of suspicious programmes
•Corporate Forensics
•Compliance audits
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, relevant sandbox-related artefacts are identified, analysed and technically categorised alongside other digital traces.

Why are Windows Sandbox artefacts important?

They can provide evidence that an isolated test environment was used and help to reconstruct technical processes within the overall context of the investigation.

Frequently Asked Questions

Which artefacts are being examined?+
Depending on the system, these may include, amongst other things, configuration data, event logs and host artefacts.
Is data from the sandbox retained permanently?+
The sandbox is, by its very nature, temporary. Whether any meaningful traces remain depends on the individual case and the artefacts present.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are sandbox artefacts enough on their own?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

LanCologne supports you in carrying out legally admissible analysis of Windows Sandbox artefacts and the objective reconstruction of digital system events.

Get in touch now