IT Forensics – Windows

Forensic analysis of Windows Sysmon artefacts – tracing processes, network connections and system events

Sysmon (System Monitor) from Microsoft Sysinternals extends Windows event logging to include detailed information on processes, network connections, driver loads, file creation and other security-related events. Provided that Sysmon has been installed and configured on a system, these logs can serve as a valuable basis for reconstructing digital events.

Enquire without obligation

A professional analysis is never carried out in isolation. Only by correlating the findings with event logs, registry artefacts, prefetch files, file system artefacts and other digital traces is it possible to arrive at a reliable technical assessment.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of Sysmon events, reconstruction of process chains, analysis of network connections and file access, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Incident Response
•Malware and ransomware investigations
•Analysis of attack chains
•Internal security investigations
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, existing Sysmon logs are analysed and technically correlated with other relevant artefacts.

Why are Sysmon artefacts important?

Provided that Sysmon was active, they provide significantly more detailed information than standard Windows logging and can therefore be of considerable assistance in reconstructing complex incidents.

Frequently Asked Questions

Is Sysmon present on every Windows system?+
No. Sysmon must be installed and configured separately.
Can Sysmon logs replace deleted activities?+
No. They complement other artefacts, but do not replace them.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are Sysmon logs alone sufficient for an expert report?+
No. They are always assessed alongside other digital evidence.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of Windows Sysmon artefacts? LanCologne can assist you with the forensically sound preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now