 .    
 


 .    .    ,      ,       .



       . :   ,   ,  ,         .           . ,   ,   .





  .    



 



  , 2026



ISBN 978-5-0071-1609-1

     Ridero




:   





  .    ,     


   ,      .

      , ,         ,     ,   ,   .   ,  .

        ,        ,       .   :  .

       .    .

 ,    ,   .  ,     ,   ,    .  ,    ,         5       .    ,      ,    .

        .   ,     .    ,      .    ,    ,    ,     .

 ,     ,   ?

  NTFS.

    .       ,      ,    ,        .   ,     .   ,         .

    : 0  1.     .    .

       .

1.   vs.  

   .

     .  ,  .

        !   .    !  !    Wi-Fi!

 ?      .  , , .    System Event Log (  )    ID 4624 (   )   SRUM (System Resource Usage Monitor).

   ?

 ,     ,   ,       .  ,    ,   Excel-,   Chrome    .

      .   -  .    Prefetch   ,         10    .

   .    .     $MFT (Master File Table)  ,  .      UserAssist  ,  . .    .

            .   .      .    - : .

2.   (    )

 ,      ,  .       .  ,   .

           .  ,   .

.

   ( Windows)       .      ,      ?      (MFT):   .     -    .

    .    , , ,  .            .

       (),    

 .

 LNK- (): Windows     ,      .  ,     Recent .       ,     .

 Jumplists ( ):     .

 Thumbnails ():   thumbcache_*.db    .  ,   .     ,         ,      .

    .   ,  .    ,    .

3.     

     :    .           .

       .       .   ,     (Last Access Time).   ,         USBSTOR.

        .

      ,    .   .

        Windows,  ,    .   ,  ,     .

,     .      ,   .  :    .   ,     ?.   .

   -:  ,   .

    (Write Blockers).      ,      ().       .   ,      ,     .

4.   

      ?

      .

  virus. exe  report.docx?

    Word  .      (Magic Bytes)  hex-   MZ ( )  PK (  Office).

  .    .   .

      2010 ,  ,    ?

      .     $STANDARD_INFORMATION  $FILE_NAME   MFT      (Timestomp).

   .     USN Journal    .

  .   .

     ,        .  ,  -    .      , ,      .     Event Logs  .     CCleaner  35-   ,    .

5.   ( )

     ,    .

  ,   .    ,    .

       . .

 ,   ,   ,    (,   ,   ).

      ,    ,        ,          .

          .

 272   (    ), 138   (  )         .  .   ,      ,  ,      .

   .     .    .

    ,   .    .

 

   .   . Hex-  .

   .  ,    .

   .   ,  .

  .  Windows   .    ,     .

    .        .

?    (),          .

 .   Setup.




  .    .       


 1910       ,       :          .

     .          ,       .         ,      .  . , , , .

     .

       .         . ,  ,  ,     .

 (  )       ,       :

   ,  ,    ,     .    !     !

, ,  .      .             .    , .

1.  :    

        ,    .   .

   ( Windows 10/11)    .        .    .

  :

   . Event Logs    (Event ID 12, 6005  ).   .        ,  .

   .  , ,  Windows, .     ,  .

  .      ,    Dirty bit     NTFS ($LogFile),    .

     ,       .   ,      ,  .



2.   :  MAC

,  .    __.docx.   .  :   ,   .    .

   MAC-.       NTFS:

 M (Modified):    .

 A (Accessed):     .

 C (Created):   .

    ,      Last Accessed.

  ?   .

 . ,      ,         .    ,      .     .     .

      ( ).    :     ,     .   ,      ?.

      .     .

3. ShellBags:  ,    

,   .      .          .

.  ,   Microsoft?

: ShellBags.    (  USRCLASS. DAT),     .  ,  ,  .

  ?  Windows ,      , .

     , Windows      ShellBags:       14:05.

     .      ,    .   .   User Hives. -   .

  .   .

4. -:     

   ,    -.

        ,      .

 (MD5, SHA-1, SHA-256)         .

                ,            -   .    .

     :

  .

   .

  -  .   .

  .

   .    --.

 , ,      ,    .

,        .   ,      ,      (      ).

    .  :      .

    .

5. USB-:    

      .       ,        .

       .

 :    ,     .

!      ,   ID      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR.

     .

       System Volume Information    .

    .          (,   ,   ),              .   Cross-contamination ( ).     .      .

6.       ?

 ,     .     (,   ),    .

.   (Write Blockers)

  ,        .

    .    .    (Write, Delete, Format)     .

      . Windows      ,  Thumbs. db,   :  , .    .

         (  Windows WriteProtect    Linux   Read-Only).   .

.     (Post-Mortem)

        ,         .

:     (, ,   ,     ).  .   .  .

   .   . .

   .

.  

      .      ,      Telegram       .

   (VM).      .    .

 

    .

    ?   .

   ?   .

   ?    .

    ?    .

:     .      .

      ,  ,  , .    ,   .

    ,    :     ,    ?.

         .

,     ,    ,     . ,    -.       .

   .




  .  ,       


     .   ,          .

          30 ,    .  ,      ,    6      ,        ,   .

     .    .  ,  ,      ,           .

       (    !      !),       .    .

    .  -.            STOP. .    .   .  .  .  ,     ,   .

  1.     (:    )

:

   : ,    ,  ,  .

,   , ,   ,  .      Telegram.    .  . .   .

  :

     138   (  ) , ,  137   (   ).

 :

   .     .

   ,        ,      ( ,      ,     ,    ).

    ,      ,       .

  .

   otkat_schema. xlsx       ( ).

     Photos_from_Turkey. rar,          .

  :

    ,            ,   ,         .

         , ,       (Photos, Social Media History),         ( ).    .  .  . .

  2.    (:     ?)

:

  ,  .    ,     - IP- (C2- ).

    .   ,   !   .

  Nmap,     ,  ,  ,        .

  :

,  .      272   (    ). ,  . ,    .

 :

  ,       (  )       (   )     .

           .

  ? .

       (Hack Back).    ,     .

  :

       .

,         OSINT (   ).

  Whois  ?  (  ).

   IP    (VirusTotal)? .

         ?  .

  ,      ,        :      .   .  .

  3.  ( )

:

     .

    , ,  .    (  ).

       .     (CSAM  Child Sexual Abuse Material).   .

  :

,   .  242.1    .

  ,               (   Autopsy),      .

       ,              (   ).

     ,       .

 :

  .       .

     (NDA)   .      ,  NDA      ,   NDA       ,        .

  :

      .      .

    .   .

   (, ,  , -,   ).

              .     .

       .       . ,     .      ,      ,     .

          .        /    (          ).

 :   

    .     ,     .

   :

    .     Excel-,      .     .

    .    ,    .

    .       ,    .

       .       ,   .      .

      .   ,  ,     .

 ,       ,      

          .

  .

(   1.  )




 1.  WINDOWS: -





 1.  (Registry):  





    ,    


   (NTFS)    Windows,      ,    . ,          (, Windows 95),       :    .

     ,    Microsoft.       .

  ,  -,    ,   .  ,   .  ,   .

.

    ,          .       (. exe ),      (    ),      .

     (Windows Registry).

    ,  Windows    -,         ,   , -,    .

1.   :  Windows  ?

     HKEY_,    .  Microsoft     ?     (),        .

   .     .        ,    20   2.   .      :   Program Files    ,     .

 User Experience (UX).    ,       , Windows ,    .   ,       .

 DLL Hell  Shared Components.     .      ,    .    Windows:     .

 , ,        .    ( CCleaner)  .      .

2.  (Hives):  ?

     .   ,    (Hives).    ,        (    ).

    :

 SYSTEM  SOFTWARE (  C:\Windows\System32\config\).    .   ,   .

 NTUSER. DAT (  C:\Users\%Username%\).   .    .      :   ,      .

     ,     HKEY_LOCAL_MACHINE  HKEY_CURRENT_USER.      .   .      NTUSER. DAT      .

3.  : -3 

    .     ,    ?

. BAM/DAM (Background Activity Moderator)    

: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

bam\State\UserSettings\ {SID_}

  Windows 10 ( 1709)     .    ,     .     .

   : BAM          .

    hack_tool. exe,    ,        35      BAM .

 :

 C:\Users\Admin\Downloads\hack_tool. exe

 : 2025-10-05 14:23:11 UTC

  .  .      .      .

. MUICache   

: HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Windows   .    ,   . exe ,     (,  vlc. exe,  VLC Media Player)   ,     .

   MUICache.

:       .

      :

C:\Temp\PortableApps\TorBrowser\firefox. exe  Tor Browser

, Tor .     Temp   .

       Portable- (   ).  :    , ,      , ,  .

MUICache    .

. UserAssist     21 

: HKEY_CURRENT_USER\Software\Microsoft\Windows

\CurrentVersion\Explorer\UserAssist

   ,         Microsoft.

UserAssist ,         .

  :

  .

   (  ).

   .

  . Microsoft    .  ?  ROT13.

   A   N, B  O    (  13 ).        5 .

- (   -)   .

  UserAssist   Veracrypt. exe,      .    .

 : 1. , , ,  , . , .

 : 542. ,   .     .      .

4. ShimCache (AppCompatCache)   

           ,    ShimCache.

: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache

     (Application Compatibility Shim). Windows    ,       .

  :

 :      1024   .

 :           .       (   ,    SYSTEM).

 :    , ,       ( ,     ).

 :   ,         (,   ).

  :

 ,          Stamp. exe.

   ShimCache.    E:\Soft\Stamp. exe.

 E:   .     .

 ShimCache .   : , ,  Stamp. exe    E:,       01.01.2024.

.  .  ,      .

5.   (CCleaner  )

    CCleaner?      .

,     .    MUICache ().      .

          BAM  ShimCache,       .

 ,      CCleaner        Prefetch  UserAssist,      .

  ,   18:00   cleaner. exe,     17:50        .    ,  ,   .

   

      .   ,   portable-,       .

          .  ,    ,   ,    ()    .

     ,     ,   Microsoft,   HEX- . 99,9%    .

    .

     . ,   ,  ( )  ,     .




 UserAssist  MUICache:  ,       ,  


           :   .

 .        password_cracker. exe.

     :

   !   !              ,    ,    !   ,  !

  ?      ,      .    (       )      . ,   .    .

    ,    Intent ()  Action ().   ,      ,     ,    .

    Windows    : UserAssist  MUICache.    ,     ,      ,      .

1. UserAssist:   

     , UserAssist      ,          .

     Windows Explorer. Ÿ    ,      ,            .

   UserAssist      .

 :

HKEY_CURRENT_USER\Software\Microsoft\Windows

\CurrentVersion\Explorer\UserAssist

          {CEBFF5CD-ACE24F4F-9178-9926F41749EA}.  GUID- (Globally Unique Identifier).

   :

 {CEBFF5CD-}        (.exe).

 {F4E57C4B-}       (.lnk).

 :  ROT13

    ,    ,    :

P:\Gbe\GbeOebmjre\gbe. rkr

F:\Uvqqra\fgrnyre. rkr

 . Microsoft,      ,       ROT13.

ROT13 (Rotate by 13 places)   ,    ,   .  A   N, B  O.

  .  .  - (Registry Explorer, RegRipper)    .     :

P:\Gbe -> C:\Tor\TorBrowser\tor. exe

F:\Uvqqra -> S:\Hidden\stealer. exe

 : Run Count  Last Execute Time

 ,      (Binary Data).     ,   .         :

 Run Counter ( ).

   ,       .

    .

    = 1,   :   ,   .  .

    = 54,    ,      .         Wi-Fi 54 .  .   .

 ,     0 ( )  1,     Win,   .   5      .

 Last Execute Time (  ).

    FILETIME.    ,      .

       (Security Log).     14:15? .    14:16.  ?  .

 Focus Time (  ).

    Windows (    ) UserAssist     ,        ( ).

    :      .  Focus Time  40 , ,       .  ,  , .

  :

UserAssist   ,    Windows Explorer ().

    ? .

    (Win+R)? .

     (CMD/PowerShell)? .

       , UserAssist      (     cmd. exe  powershell. exe).

2. MUICache:  

 UserAssist   ,  MUICache   .

 : Multilingual User Interface Cache.

 :

HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

(      ,   Shell\MuiCache).

   :

    word. exe, Windows           : Microsoft Word,     .

      () . exe      ,        .

    :

   Portable-.

 ,    ,      Uninstall.       ,    MUICache.

    G:\Soft\RubberDucky. exe   USB Attack Tool?

 .  ,       G:.

   .

   .    Recent.   ( )  UserAssist  .

   MUICache    .    .

      :      Telegram   !.  MUICache,  Telegram. exe -> Telegram Desktop.   .

  .

      . ,   svchost. exe,     C:\Temp\.

  MUICache  : C:\Temp\svchost. exe.

  svchost    System32.      . MUICache     .

3. :      

    .   .

        :

 1.   NTUSER. DAT  USRCLASS. DAT.

 2.    Registry Explorer (  ,   ).

 3.   UserAssist.   Run Count.

  Eraser. exe (   ).

 : 12.

  :   18:00.

:    .

 4.   MUICache.

   ,    UserAssist (,     ,    ).

  D:\Games\Doom. exe.

:    .     Games .

 5. ( )   Prefetch.

Prefetch (    )      N /.

  UserAssist    ,   Prefetch       .

 ,  -    C:\Windows\Prefetch,   .

    .  Prefetch      .     .

   

  (   ,      )  :

  regedit. exe.

   HKEY_CURRENT_USER\Software\Microsoft\Windows

\CurrentVersion\Explorer\UserAssist.

    GUID (   CE).

    .   ?

    (, P:\Jvaqbjf\flfgr32\pzq. rkr).

    rot13.com   .

 ,   .

 ,     .      , ,     ,  ,      .

 :

UserAssist    .       .

  ,    ,       , ROT13        .

       .

      .    ,    ,      .




 USBSTOR:   .     ,     


  ,     :   ,       ,       ,     .

    80%      :   ,      .            Tor.   .

     .  :   ,  ,   .  .

,    .

Windows  USB-.   .       (,   ,      ),           .

,   ,   : , ,         .

      USBSTOR.        .

1.  :    ?

    USB,   Plug and Play (PnP).

  :  USB :  , ?.

 :   :  Kingston DataTraveler 3.0,    123456789.

   : Windows        ,           .

 :    (E:, F:  ..)     .

       HKEY_LOCAL_MACHINE\SYSTEM.

     .     .       USB  .

2.  :   ?

   ,         (System Hive).

. USBSTOR   

: HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

    ,  -    .

 :

 Vendor & Product: , Disk&Ven_Kingston&Prod_DataTraveler_3.0.

 Instance ID ( ):        ,  50E549C688C3BE7189940366&0.

   :

 &0    ,     ,   .

   &1     ,      (     -),  Windows      PnP-.

    (&0)   -.        .

. MountedDevices   

: HKLM\SYSTEM\MountedDevices

       .




  .


   .

   ,     (https://www.litres.ru/book/raznoe/logi-ne-vrut-prakticheskaia-forenzika-dlia-paranoikov-74428887/)  .

      Visa, MasterCard, Maestro,    ,   ,     ,  PayPal, WebMoney, ., QIWI ,       .


