“Which log, which field, and what does it not tell me?”
Cheat sheets for Windows event logs, memory forensics and timeline building. Each one is a page you keep open, with the defaults that silently hide evidence called out.
Which fields in a sign-in record separate a traveller from a stolen session, what the common error codes mean, where non-interactive sign-ins hide, and how long any of it is kept.
The status and sub-status codes in a failed Windows logon, the Kerberos result codes on the domain controller, and which combination is a typo, a locked account, a stale service or somebody guessing.
A timeline is only as good as your understanding of what each timestamp means. The artifacts that carry time on Windows, what event each one actually records, the zone it is stored in, and the commands to build and cut a super timeline.
What to capture before you touch anything else, how to check the image is usable, and the Volatility 3 plugins grouped by the question they answer, with what each one cannot tell you.
Organised by what you are trying to establish rather than by number: who logged on and how, what ran, what persisted, what was tampered with. Every entry says which log, whether it is on by default, and what it does not tell you.
