Sign In
In this module

The NE Forensic Environment

Module 0 · Free
Operational Objective
Forensic artifact analysis does not happen in a vacuum. It happens in the context of a specific organization's infrastructure, a specific incident's scope, specific legal requirements, and specific stakeholder expectations. An examiner who understands MFT record structures but does not know the network topology, the endpoint configurations, the logging architecture, and the legal framework of the investigation will produce technically accurate but operationally incomplete findings. This subsection introduces the three Northgate Engineering investigation scenarios that run through every module in this course. Each scenario defines the organizational context, the incident scope, the evidence available, the legal requirements, the stakeholders, and the specific artifact questions the investigation must answer. Understanding these scenarios before diving into artifact-specific modules ensures that every technique you learn has an immediate operational application — you're not learning abstract artifact structures, you're learning the specific analysis that answers specific questions for specific investigations.
Deliverable: Complete understanding of the three NE investigation scenarios including infrastructure context, evidence inventory, legal requirements, stakeholder expectations, and the specific forensic questions each investigation must answer. The mapping between investigation questions and artifact categories that determines analysis priority for each scenario.
Estimated completion: 30 minutes
THREE INVESTIGATION SCENARIOS — NORTHGATE ENGINEERING INC-NE-2026-0915 Insider Data Exfiltration Departing engineer, 6-week window USB + cloud storage exfiltration Legal hold, HR proceeding pending Primary artifacts: ShellBags · LNK · Jump Lists USN Journal · SRUM · USB history Standard: preponderance HR legal + potential civil INC-NE-2026-1022 Ransomware Attack 72 hours initial access to encryption 12 hosts compromised, 3 servers encrypted Insurance claim + regulatory notification Primary artifacts: Prefetch · Amcache · Event Logs MFT timeline · Registry persistence Standard: insurance + regulatory GDPR notification assessment INC-NE-2026-1130 Unauthorized Access Dispute Employee denies accessing restricted share HR investigation, administrative leave Evidence must prove or disprove access Primary artifacts: ShellBags · LNK · Jump Lists Event Logs (auth) · MFT timestamps Standard: preponderance Employment tribunal potential

Figure WF0.10 — Three investigation scenarios that thread through every module. Each scenario has different primary artifact categories, different legal standards, and different stakeholder expectations. The artifact analysis techniques in each module are applied to these scenarios so that every technique has an immediate operational context.

Northgate Engineering: the environment

Northgate Engineering Ltd is a precision manufacturing company with 810 employees across three UK sites. Their IT infrastructure is typical of a mid-size enterprise: M365 E5 licensing, Entra ID for identity, Defender XDR for security, Sentinel for SIEM, a hybrid Active Directory environment with four domain controllers across three sites, 865 managed endpoints (predominantly Windows 11, some Windows 10), 12 Windows servers, 6 RHEL and 2 Ubuntu servers, Palo Alto Prisma Access SD-WAN, and BlueVoyant as a managed SOC partner.

The endpoints are relevant to this course. The standard workstation configuration is Windows 11 Enterprise 23H2, M365 Apps for Enterprise (Office), Defender for Endpoint P2 (onboarded), BitLocker enabled (recovery keys in Entra ID), 256GB or 512GB NVMe SSD, 16GB RAM. Sysmon is deployed across all endpoints with a standard configuration. PowerShell ScriptBlock logging is enabled via GPO. Advanced audit policies are configured for process creation (including command line), logon events, and object access (on file servers). Prefetch is enabled on all workstations (default) and disabled on servers (default).

The file servers run Windows Server 2022 with NTFS volumes. The restricted Engineering share (\\SRV-NGE-FS01\Engineering\) has file access auditing enabled (Event ID 4663) for the Manufacturing and R&D subdirectories. USB device use is permitted but logged via Defender for Endpoint device control (monitoring mode, not blocking).

This environment determines what artifacts are available for each investigation: Sysmon provides process creation and network connection telemetry. Advanced audit policies provide authentication and object access events. Defender for Endpoint provides endpoint telemetry via Advanced Hunting. BitLocker means disk images from powered-off systems require recovery keys. NVMe SSDs mean deleted file content recovery is unreliable due to TRIM. The file server's object access auditing means authentication and file access events are available for server-side analysis.

Scenario 1: INC-NE-2026-0915 — insider data exfiltration

The situation. David Chen, a senior manufacturing engineer at Northgate Engineering, submitted his resignation on September 1, 2026 with a notice period ending September 30. On September 12, the Engineering Director flagged a concern: Chen had been working unusually late hours and had requested access to several file shares outside his normal role in the weeks before his resignation. DLP alerts in Defender for Cloud Apps show Chen accessed 847 files in the restricted Manufacturing Specifications folder between August 1 and September 12 — a ten-fold increase over his previous baseline of approximately 80 files per month.

The evidence. NE's security team performed a KAPE standard collection from Chen's workstation (DESKTOP-NGE-ENG14) while he was in a meeting. The collection includes: $MFT, $UsnJrnl, all registry hives with transaction logs, Prefetch files, Event Logs (all channels), SRUM database, browser data (Chrome), LNK files, Jump Lists, and $Recycle.Bin. Additionally, file server logs from SRV-NGE-FS01 (Security Event Log with 4663 object access events) and Defender for Endpoint Advanced Hunting data for DESKTOP-NGE-ENG14 are available.

The forensic questions.

  1. Which folders in the restricted Engineering share did Chen access, and when? (ShellBags, Event Logs)
  2. Which specific files did Chen open? (LNK files, Jump Lists, Event Log 4663)
  3. Did Chen copy files to USB storage? If so, which files, when, and to which device? (USN Journal, USB device history, MFT timestamps)
  4. Did Chen copy files to cloud storage or personal email? (SRUM transfer volumes, browser history, cloud sync artifacts)
  5. What tools did Chen use to archive or compress files? (Prefetch, Amcache)
  6. What is the total volume of data potentially exfiltrated? (SRUM bytes sent by application)
  7. Did Chen attempt to cover his tracks? (Anti-forensic indicator checklist)

The legal context. Legal hold has been placed on Chen's workstation and all related evidence. The investigation supports an HR disciplinary proceeding and potential civil action for breach of contract and misappropriation of trade secrets. The evidence standard is preponderance (balance of probabilities) — lower than criminal beyond reasonable doubt, but the methodology must still be defensible. Chen's solicitor may retain a forensic expert to review the findings.

Scenario 2: INC-NE-2026-1022 — ransomware attack

The situation. On October 22, 2026 at 06:14 UTC, Northgate Engineering's BlueVoyant SOC detected mass file encryption activity on three servers: SRV-NGE-FS01 (primary file server), SRV-NGE-APP02 (application server), and SRV-NGE-DB01 (database server). By 06:30, the ransom note was confirmed and containment was initiated — affected servers isolated, VPN connections terminated, all credentials for administrative accounts reset. Initial scoping identified 12 compromised endpoints across two NE sites. The ransomware was deployed via PsExec from a compromised IT administrator account.

The evidence. Forensic images (E01 format) of: patient zero workstation (DESKTOP-NGE-FIN01 — finance department), lateral movement host (DESKTOP-NGE-IT03 — IT department), and the encrypted file server (SRV-NGE-FS01). KAPE triage collections from the remaining 9 compromised endpoints. Defender for Endpoint Advanced Hunting data for all 12 hosts. Entra ID sign-in logs and audit logs for the investigation timeframe. Sentinel incidents and alerts. Volume Shadow Copies were deleted by the ransomware (via vssadmin and WMI) but may have partial copies on some endpoints where the deletion failed.

The forensic questions.

  1. What was the initial access vector? (Patient zero endpoint analysis — email artifacts, browser history, Prefetch, MFT)
  2. When did the attacker gain access and how long were they in the environment before encryption? (Timeline from initial compromise to ransomware deployment)
  3. What credentials were compromised and how? (Credential harvesting tool evidence — Prefetch, Amcache, Event Logs for LSASS access)
  4. How did the attacker move laterally across the network? (Cross-host authentication events, PsExec service creation, RDP connection artifacts)
  5. What persistence mechanisms were installed? (Registry analysis — Services, Run keys, scheduled tasks, COM hijacks)
  6. Was personal data accessed or exfiltrated before encryption? (GDPR Article 33 notification assessment — file access evidence, SRUM transfer volumes, C2 communication evidence)
  7. Can any encrypted data be recovered from shadow copies? (VSS analysis — which snapshots survived the deletion attempt)
  8. What anti-forensic activity did the attacker perform? (Event Log clearing, Prefetch deletion, timestomping, tool cleanup)

The legal context. The investigation supports an insurance claim under NE's cyber insurance policy (the insurer requires a forensic examination report detailing initial access, scope, and remediation). GDPR Article 33 notification assessment is required within 72 hours — the examiner must determine whether personal data was accessed or exfiltrated. NE's legal counsel is coordinating with law enforcement (National Crime Agency) — evidence preservation must meet criminal investigation standards in case of future prosecution.

Scenario 3: INC-NE-2026-1130 — unauthorized access dispute

The situation. Sarah Williams, a marketing coordinator at Northgate Engineering, has been accused of accessing the restricted HR\Compensation folder on SRV-NGE-FS01. The HR Director discovered that compensation data for all Engineering department employees appeared in a document Williams shared with a recruiter at a competing firm. Williams denies ever accessing the HR share and claims the compensation data was provided to her verbally by a colleague. Williams has been placed on administrative leave. Her workstation (DESKTOP-NGE-MKT07) is powered on but logged out and has been physically secured by IT.

The evidence. KAPE standard collection from Williams' workstation (collected after administrative leave was implemented). File server Security Event Log from SRV-NGE-FS01 (4624 authentication, 4663 object access for the HR\Compensation directory). Defender for Endpoint data for DESKTOP-NGE-MKT07. The document shared with the recruiter (recovered from Williams' sent email).

The forensic questions.

  1. Did Williams navigate to the HR\Compensation folder on the file server? (ShellBags in UsrClass.dat)
  2. Did Williams open specific compensation files? (LNK files in Recent folder, Jump Lists for Excel/Word)
  3. Did Williams authenticate to the file server at relevant times? (Event Log 4624 on file server, correlated with workstation logon events)
  4. Did Williams copy compensation files to her local workstation? (MFT for local copies, USN Journal for file creation events)
  5. Is there evidence Williams emailed compensation data to external recipients? (Browser artifacts, email client artifacts, Defender for Cloud Apps DLP data)
  6. Is there evidence consistent with Williams' defense — that she received the data verbally? (Absence of file access artifacts could support her claim, but absence is not proof)
  7. Did Williams attempt to conceal her access? (Anti-forensic indicator checklist — clearing browser history, deleting files, timestomping)

The legal context. The investigation supports an HR disciplinary proceeding that may escalate to an employment tribunal if Williams contests the decision. The evidence standard is preponderance. The examiner must be objective — the examination must be equally capable of proving Williams accessed the data and of supporting her defense if the evidence is genuinely absent. A forensic examination conducted with a presumption of guilt will be challenged by Williams' representative and may be found unreliable.

Decision point

The three NE investigation scenarios have different legal contexts: INC-NE-2026-0915 (insider threat — HR proceeding, preponderance standard), INC-NE-2026-1022 (ransomware — insurance claim + potential regulatory notification), INC-NE-2026-1130 (access dispute — HR proceeding, preponderance standard). How does the legal context affect your analysis approach?

The legal context determines the documentation standard, not the analysis methodology. The artifact analysis is the same — extract, parse, correlate, conclude. But the reporting differs: the insurance claim requires specific damage quantification (files encrypted, systems affected, recovery cost). The regulatory notification requires personal data impact assessment (was PII involved?). The HR proceedings require clear, defensible findings at the preponderance standard (more likely than not). All three require methodology documentation, but the ransomware scenario demands the most rigorous chain of custody because it may escalate to law enforcement involvement. Plan your documentation from the start — retrofitting legal-grade documentation after analysis is complete is expensive and error-prone.

Try It — Map Artifacts to Investigation Questions

Choose one of the three scenarios and map every investigation question to the specific artifact categories and specific artifact types that could answer it. For each mapping, assess: what confidence level does this artifact provide for this question? What corroborating artifacts would strengthen the finding?

This exercise prepares you for the artifact-specific modules (WF1-WF10) by establishing the operational context: when you learn MFT record analysis in WF1, you already know that MFT timestamps answer question 4 in INC-NE-2026-0915 (did Chen copy files?) and question 1 in INC-NE-2026-1022 (when did the malicious file first appear?). When you learn ShellBag analysis in WF4, you already know it answers question 1 in INC-NE-2026-0915 and question 1 in INC-NE-2026-1130.

Compliance Myth: "A forensic examiner should start with a hypothesis and look for evidence to confirm it"

The myth: Efficient forensic investigation starts with a hypothesis (e.g., "the employee exfiltrated data") and focuses evidence collection and analysis on confirming or denying that hypothesis. This is focused and efficient.

The reality: This is confirmation bias in forensic form. An examiner who starts with "the employee exfiltrated data" will unconsciously favor evidence that supports the hypothesis and discount evidence that contradicts it. INC-NE-2026-1130 illustrates the danger: if the examiner assumes Williams accessed the compensation data, they may interpret ambiguous artifacts as confirming access when they are actually consistent with normal activity. The correct methodology is: collect all relevant artifacts, analyze them systematically, let the evidence lead to conclusions, and document findings that both support and contradict any preliminary hypothesis. The examiner's role is truth-finder, not advocate — particularly in HR investigations where an incorrect finding can end a career.

Troubleshooting

"These scenarios are specific to Northgate Engineering — how do they apply to my environment?" The scenarios are vehicles for teaching artifact analysis in operational context. The specific names, dates, and file paths are fictional. The investigation types — insider threat, ransomware, access dispute — are universal. The artifact analysis techniques, the evidence reliability assessments, the corroboration methods, and the reporting standards apply to any Windows forensic examination regardless of the organization. Replace "Northgate Engineering" with your organization, and the investigation methodology is the same.

"My organization doesn't have Sysmon, advanced audit policies, or Defender for Endpoint." The NE environment is well-configured, which means more artifact sources are available. In environments with less telemetry, the disk artifacts covered in this course become even more important because they may be the only evidence available. If Event Logs don't contain process creation events (no advanced audit policy), Prefetch and Amcache become the primary execution evidence. If there's no EDR, the MFT, USN Journal, and registry become the primary sources for file and activity reconstruction. The artifact analysis skills are more valuable, not less, in under-instrumented environments.

"INC-NE-2026-1130 asks me to prove a negative — how do I prove Williams didn't access something?" You can't prove a negative from artifact evidence alone. What you can do is document: (a) the artifacts you examined and what they showed (or didn't show), (b) the artifacts you expected to find if the access occurred (ShellBags, LNK files, authentication events) and whether they are present or absent, (c) alternative explanations for absence (artifacts don't exist because the access didn't occur, or artifacts were deleted, or artifacts rotated out of retention). The examiner reports what the evidence shows and what conclusions the evidence supports — including the conclusion that the evidence is inconclusive if that is the honest assessment.

Operational Artifact — Investigation Scope and Question Framework

For every forensic investigation, document before analysis begins: Investigation ID and type (insider threat, ransomware, unauthorized access, etc.). Scope (which systems, which users, which timeframe). Specific questions (numbered list of what the investigation must answer). Evidence inventory (what artifacts are available for each system — KAPE collection, disk image, cloud logs, EDR data). Legal context (evidence standard, stakeholders, reporting requirements, chain of custody obligations). Artifact mapping (for each question, which artifact categories are primary and which are corroborating). Analysis plan (which systems and artifact categories to analyze first, second, third — based on question priority and evidence availability). This framework prevents scope creep (analyzing artifacts that don't answer investigation questions), ensures completeness (every question has mapped artifact sources), and provides the methodology documentation that legal proceedings require.

You are the forensic examiner assigned to INC-NE-2026-1130 (unauthorized access dispute). Sarah Williams' solicitor contacts you and states: "My client denies accessing the HR folder. Your examination must include analysis of whether the artifacts are consistent with her denial — not just whether they confirm the accusation." How should you respond to this request?
Decline the request — as the examiner hired by NE, your role is to find evidence of Williams' access. The defense can hire their own expert to look for exculpatory evidence. Examining both sides would create a conflict of interest.
Acknowledge that this is correct forensic methodology. An objective examination should evaluate the evidence in both directions — looking for artifacts consistent with access (ShellBags, LNK files, authentication events) AND assessing whether the absence of such artifacts is meaningful. If ShellBags don't show the HR folder, that finding should be documented. If authentication logs don't show Williams connecting to the file server during the relevant period, that finding should be documented. The examination report should present what the evidence shows and does not show, with confidence assessments, and let the decision-maker (HR, tribunal) draw conclusions. An examiner who only looks for incriminating evidence is an advocate, not an expert — and their methodology will be challenged.
Accept the request but note that the absence of artifacts does not prove Williams didn't access the folder — artifacts could have been deleted or rotated. The examination should focus on what is present, not what is absent, because absence is always ambiguous.
Refuse to communicate with Williams' solicitor directly — all communication should go through NE's legal counsel. The examination methodology is determined by the examiner's professional judgment, not by either party's requests.
© 2026 Ridgeline Cyber Defence™ Ltd. Content may not be reproduced or redistributed. Worked artifacts may be adapted for use within your organization.

You've built the foundations of artifact-level forensic analysis.

WF0 gave you the taxonomy, NTFS architecture, and the five-step methodology. WF1 took you inside the MFT at the binary level — every attribute, every timestamp, every edge case. From here, every artifact category gets the same raw-first treatment.

  • WF2–WF10: every major Windows artifact decoded at binary level — USN Journal, Prefetch, Amcache, Shimcache, ShellBags, LNK, Jump Lists, SRUM, Event Logs, and the Registry hives
  • INC-NE-2026-0915 (WF13) — Insider data exfiltration capstone. Work the complete investigation from USB history to OneDrive exfiltration evidence
  • INC-NE-2026-1022 (WF14) — Ransomware capstone. Three-host triage (FIN01 → IT03 → FS01) across the 72-hour attack chain
  • The lab pack — 25+ realistic evidence files in 10 formats, simulated KAPE triage pre-populated, both capstones deployable to your own VM
  • Anti-forensic detection methodology — defeat timestomping, log clearing, and Prefetch deletion with cross-artifact correlation
Unlock with Specialist — £25/mo See Full Syllabus

Cancel anytime

← Previous Next →