We mostly see Windows Scheduled Tasks creation, and usually deal with tasks associated with the Task Scheduler service. It utilizes RPC Interface (i.e., ITaskSchedulerService) to create, run, and modify them.

Prefetch files are created by Windows to speed up the loading process by caching the neccessary data. When we fire up a process, it will cache the details like files accessed and stores it in small file i.e. prefetch files under Prefetch subfolder in Windows. When the application is opened for the next time, it will load the files accessed. Windows Prefetch files are located in C:\Windows\Prefetch\*.pf. From forensic perspective, it provides various valuable information like

PoolTag is a 4 bytes value (unsigned int value) present in the header (i.e. POOL_HEADER) .Microsoft creates pool tag mostly for debugging purposes. So, whenever Kernel creates any object in pool memory, it creates a POOL_HEADER which contains a PoolTag field which contains information regarding what kind of object is being created.

A deep dive into Windows objects, focusing on their structure, headers, and relationships. This blog covers key components like _OBJECT_HEADER, OBJECT_TYPE, and ObTypeIndexTable, providing insights into how Windows organizes and references objects.

This post explores application dumps, a crucial tool for debugging and analyzing software errors, offering insights into memory analysis and troubleshooting techniques