Skip to content
Binalyze Knowledge Base

Windows Collections

Windows Evidence List

Section titled “Windows Evidence List”
# Evidence
(click for details)		 Category Parsed Sent to the
Investigation Hub		 Raw Files
Collected
1 $Boot DiskFilesystem No Yes Yes
2 $Log File DiskFilesystem No Yes Yes
3 $Secure:$SDS DiskFilesystem No Yes Yes
4 $TxfLog $Tops:$T DiskFilesystem No Yes Yes
5 ARP Table Network Yes Yes No
6 AVG Logs Applications No No Yes
7 Action1 RMM Logs Applications No No Yes
8 Active Directory Logs Applications No No Yes
9 AI Agent Events AI Yes Yes No
10 AI Agents AI Yes Yes No
11 AI Artifacts AI No Yes Yes
12 AI Commands AI Yes Yes No
13 AI Configs AI Yes Yes No
14 AI Hooks AI Yes Yes No
15 AI MCP AI Yes Yes No
16 AI Models AI Yes Yes No
17 AI Rules AI Yes Yes No
18 AI Secrets AI Yes Yes No
19 AI Sessions AI Yes Yes No
20 AI Skills AI Yes Yes No
21 AmCache System Yes Yes Yes
22 AmmyAdmin Logs Applications No No Yes
23 Antivirus Information System Yes Yes No
24 AnyDesk Logs Applications No No Yes
25 Apache Logs Applications No No Yes
26 AppCompactCache System Yes Yes No
27 AppPaths System Yes Yes No
28 Avast Logs Applications No No Yes
29 Avira Logs Applications No No Yes
30 Bitdefender Logs Applications No No Yes
31 Brave Bookmarks Applications Yes Yes No
32 Brave Browsing History Applications Yes Yes No
33 Brave Cookies Applications Yes Yes No
34 Brave Downloads Applications Yes Yes No
35 Brave Extensions Applications Yes Yes No
36 Brave Favicons Applications Yes Yes No
37 Brave Form History Applications Yes Yes No
38 Brave Local Storage Applications Yes Yes No
39 Brave Login Data Applications Yes Yes No
40 Brave Sessions Applications Yes Yes No
41 Brave Thumbnails Applications Yes Yes No
42 Brave User Profiles Applications Yes Yes No
43 Brave Web Storage Applications Yes Yes No
44 CIDSizeMRU System Yes Yes No
45 CLR System No Yes Yes
46 Carbon Black Logs Applications No No Yes
47 Clipboard History System Yes Yes Yes
48 Chrome Bookmarks Applications Yes Yes No
49 Chrome Browsing History Applications Yes Yes No
50 Chrome Cookies Applications Yes Yes No
51 Chrome Downloads Applications Yes Yes No
52 Chrome Extensions Applications Yes Yes No
53 Chrome Favicons Applications Yes Yes No
54 Chrome Form History Applications Yes Yes No
55 Chrome Local Storage Applications Yes Yes No
56 Chrome Login Data Applications Yes Yes No
57 Chrome Sessions Applications Yes Yes No
58 Chrome Thumbnails Applications Yes Yes No
59 Chrome User Profiles Applications Yes Yes No
60 Chrome Web Storage Applications Yes Yes No
61 Cisco AMP Logs Applications No No Yes
62 Collect LNK Files System Yes Yes Yes
63 Collect SRUM Database Files System No No Yes
64 ComboFix Applications No No Yes
65 Cortana History Applications No No Yes
66 Crash Dump Information System Yes Yes No
67 Cybereason Logs Applications No No Yes
68 Cylance Logs Applications No No Yes
69 DHCP Server Logs Applications No No Yes
70 DNS Cache Network Yes Yes No
71 DNS Server Logs Applications No No Yes
72 DNS Servers Network Yes Yes No
73 Deep Instinct Logs Applications No No Yes
74 Default Browser Applications Yes Yes No
75 Dependency Manifests Applications Yes Yes No
76 Discord Desktop Cache Applications No No Yes
77 Docker Changes Applications Yes Yes No
78 Docker Container Logs Applications Yes Yes No
79 Docker Containers Applications Yes Yes No
80 Docker Image History Applications Yes Yes No
81 Docker Images Applications Yes Yes No
82 Docker Info Applications Yes Yes No
83 Docker Networks Applications Yes Yes No
84 Docker Processes Applications Yes Yes No
85 Docker Volumes Applications Yes Yes No
86 Downloaded Files Information System Yes Yes No
87 Driver Objects System Yes Yes No
88 Drivers List System Yes Yes No
89 Dropbox Cache Applications No No Yes
90 Dropbox Databases Applications No No Yes
91 Dropbox Logs Applications No No Yes
92 Dump Brave Indexed DB Applications Yes Yes No
93 Dump Brave Preferences Applications No No Yes
94 Dump Chrome Indexed DB Applications Yes Yes No
95 Dump Chrome Preferences Applications No No Yes
96 Dump Edge Indexed DB Applications Yes Yes No
97 Dump Edge Preferences Applications No No Yes
98 Dump Firefox Preferences Applications No No Yes
99 Dump Opera Indexed DB Applications Yes Yes No
100 Dump Opera Preferences Applications No No Yes
101 Dump QQ Indexed DB Applications Yes Yes No
102 Dump QQ Preferences Applications No No Yes
103 Dump Vivaldi Indexed DB Applications Yes Yes No
104 Dump Vivaldi Preferences Applications No No Yes
105 ETL System No Yes Yes
106 Edge Bookmarks Applications Yes Yes No
107 Edge Cookies Applications Yes Yes No
108 Edge Downloads Applications Yes Yes No
109 Edge Extensions Applications Yes Yes No
110 Edge Favicons Applications Yes Yes No
111 Edge Form History Applications Yes Yes No
112 Edge Local Storage Applications Yes Yes No
113 Edge Login Data Applications Yes Yes No
114 Edge Sessions Applications Yes Yes No
115 Edge Thumbnails Applications Yes Yes No
116 Edge User Profiles Applications Yes Yes No
117 Edge Web Storage Applications Yes Yes No
118 Elastic Logs Applications No No Yes
119 Environment Variables System Yes Yes No
120 Eset Logs Applications No No Yes
121 Event Log EVT Files EventLogs Yes Yes No
122 Event Log EVT Records EventLogs Yes Yes Yes
123 Event Log EVTX Files EventLogs Yes Yes No
124 EventTranscript DB System Yes Yes Yes
125 Evernote Databases Applications No No Yes
126 Evernote Drag and Drop Files Applications No No Yes
127 Evernote Logs Applications No No Yes
128 Everything History Applications No No Yes
129 F-Secure Logs Applications No No Yes
130 Facebook Cache Applications No No Yes
131 Facebook Databases Applications No No Yes
132 FileExts System Yes Yes No
133 FileZilla Sessions Applications No No Yes
134 FireEye Logs Applications No No Yes
135 Firefox Browsing History Applications Yes Yes No
136 Firefox Cookies Applications Yes Yes No
137 Firefox Downloads Applications Yes Yes No
138 Firefox Extensions Applications Yes Yes No
139 Firewall Rules Network Yes Yes No
140 FirstFolder System Yes Yes No
141 Github Desktop Cache Applications No No Yes
142 Github Desktop Databases Applications No No Yes
143 Github Desktop Logs Applications No No Yes
144 GoTo Logs Applications No No Yes
145 Google Drive Databases Applications No No Yes
146 Hibernation File Memory No Yes Yes
147 HitmanPro Logs Applications No No Yes
148 Hosts Network Yes Yes Yes
149 IE 10,11,Edge Browsing History Applications Yes Yes Yes
150 IE 7,8,9 Browsing History Applications Yes Yes Yes
151 IIS Logs Applications No No Yes
152 INF Setup System No Yes Yes
153 IPv4 Routes Network Yes Yes No
154 Iconcache System No Yes Yes
155 IDE Extensions Applications Yes Yes No
156 Installed Applications System Yes Yes No
157 JumpList Automatic Entries System Yes Yes No
158 JumpList Automatic Files System Yes Yes Yes
159 JumpList Custom Entries System Yes Yes No
160 JumpList Custom Files System Yes Yes Yes
161 Kaseya Logs Applications No No Yes
162 LastVisitedPidlMRU System Yes Yes No
163 Level Logs Applications No No Yes
164 LinkedIn Cache Applications No No Yes
165 LogMeIn Logs Applications No No Yes
166 MBR DiskFilesystem No Yes Yes
167 MFT DiskFilesystem No Yes Yes
168 MFT Mirror DiskFilesystem No Yes Yes
169 MFT as CSV DiskFilesystem Yes No No
170 MSSQL Logs Applications No No Yes
171 MalwareBytes Logs Applications No No Yes
172 Map Network Drive MRU System Yes Yes No
173 McAfee Logs Applications No No Yes
174 Microsoft Calendar Applications No No Yes
175 Microsoft Exchange Logs Applications No No Yes
176 Microsoft Mail Applications No No Yes
177 Microsoft Maps Applications No No Yes
178 Microsoft Outlook Applications No No Yes
179 Microsoft People Applications No No Yes
180 Microsoft Photos Applications No No Yes
181 Microsoft Sticky Notes Applications No No Yes
182 Microsoft Store Applications List Applications No No Yes
183 Microsoft Voice Record History Applications No No Yes
184 MongoDB Logs Applications No No Yes
185 Mozilla Thunderbird Applications No No Yes
186 NTDS.dit System No Yes Yes
187 Network Adapters Network Yes Yes No
188 Network Shares Network Yes Yes No
189 Notepad++ Sessions Applications No No Yes
190 Object Directory System Yes Yes No
191 OfficeMRU System Yes Yes No
192 Old Registry Hives System No Yes Yes
193 OneDrive Logs Applications No No Yes
194 OpenSavePidlMRU System Yes Yes No
195 OpenVPN Config Applications No No Yes
196 Opera Bookmarks Applications Yes Yes No
197 Opera Browsing History Applications Yes Yes No
198 Opera Cookies Applications Yes Yes No
199 Opera Downloads Applications Yes Yes No
200 Opera Extensions Applications Yes Yes No
201 Opera Favicons Applications Yes Yes No
202 Opera Form History Applications Yes Yes No
203 Opera Local Storage Applications Yes Yes No
204 Opera Login Data Applications Yes Yes No
205 Opera Sessions Applications Yes Yes No
206 Opera Thumbnails Applications Yes Yes No
207 Opera User Profiles Applications Yes Yes No
208 Opera Web Storage Applications Yes Yes No
209 PDB Information System Yes Yes No
210 Page File Memory No Yes Yes
211 Palo Alto Logs Applications No No Yes
212 Parse LNK Files System Yes Yes No
213 Parse SRUM Application Timeline System No Yes No
214 Parse SRUM Application Usage System No Yes No
215 Parse SRUM Energy Usage System No Yes No
216 Parse SRUM Network Connectivity System No Yes No
217 Parse SRUM Network Usage System No Yes No
218 Powershell ConsoleHost History System Yes Yes No
219 Powershell Logs System No Yes Yes
220 Prefetch Files System Yes Yes Yes
221 Proxy List Network Yes Yes No
222 QQ Bookmarks Applications Yes Yes No
223 QQ Browsing History Applications Yes Yes No
224 QQ Cookies Applications Yes Yes No
225 QQ Downloads Applications Yes Yes No
226 QQ Extensions Applications Yes Yes No
227 QQ Favicons Applications Yes Yes No
228 QQ Form History Applications Yes Yes No
229 QQ Local Storage Applications Yes Yes No
230 QQ Login Data Applications Yes Yes No
231 QQ Sessions Applications Yes Yes No
232 QQ Thumbnails Applications Yes Yes No
233 QQ User Profiles Applications Yes Yes No
234 QQ Web Storage Applications Yes Yes No
235 Quick Assist System Yes Yes No
236 RAM Image Memory No Yes Yes
237 RDP Cache System No Yes Yes
238 RealVNC Logs Applications No No Yes
239 Recent File Cache System No Yes Yes
240 RecentDocs System Yes Yes No
241 Recycle Bin Information System Yes Yes No
242 Registry Hives System No Yes Yes
243 Registry Items System Yes Yes Yes
244 RemComSvc Logs Applications No No Yes
245 Remote Utilities Logs Applications No No Yes
246 RogueKiller Reports Applications No No Yes
247 RunMRU System Yes Yes No
248 Running Processes and Modules System Yes Yes No
249 SAM Users and Groups System Yes Yes No
250 SDB System No Yes Yes
251 SRUM System Yes Yes Yes
252 SUPERAntiSpyware Logs Applications No No Yes
253 Scheduled Tasks System Yes Yes Yes
254 ScreenConnect (ConnectWise Control) Application Data Applications No No Yes
255 Search History Applications No No Yes
256 SentinelOne Logs Applications No No Yes
257 Service List System Yes Yes Yes
258 Shadow Copy as CSV DiskFilesystem Yes Yes No
259 ShellBags System Yes Yes No
260 ShellFolders System Yes Yes No
261 Skype Databases Applications No No Yes
262 Skype Media Applications No No Yes
263 Sophos Logs Applications No No Yes
264 Sourcefire FireAMP Logs Applications No No Yes
265 Splashtop Logs Applications No No Yes
266 Spotify Cache Applications No No Yes
267 Spotify Recently Played List Applications No No Yes
268 Startup Items System Yes Yes Yes
269 Sublime Text Sessions Applications No No Yes
270 Superfetch System No Yes Yes
271 Supremo Remote Desktop Logs Applications No No Yes
272 Swap File Memory No Yes Yes
273 Symantec Logs Applications No No Yes
274 System Restore Points Information System Yes Yes No
275 TCP Table Network Yes Yes No
276 Tanium Logs Applications No No Yes
277 Teamviewer Logs Applications No No Yes
278 Telegram Desktop Data Applications No No Yes
279 Telegram Desktop Download Applications No No Yes
280 Thumbcache System No Yes Yes
281 TightVNC Logs Applications No No Yes
282 Tortoise Git Logs Applications No No Yes
283 TotalAv Logs Applications No No Yes
284 Trend Micro Logs Applications No No Yes
285 Twitter Cache Applications No No Yes
286 Twitter Databases Applications No No Yes
287 TypedPaths System Yes Yes No
288 TypedURLs System Yes Yes No
289 UDP Table Network Yes Yes No
290 USB Storage History DiskFilesystem Yes Yes No
291 USN Journal DiskFilesystem No Yes Yes
292 USN Journal $Max DiskFilesystem No Yes Yes
293 USN Journal as CSV DiskFilesystem Yes Yes No
294 UltraVNC Logs Applications No No Yes
295 Ultraviewer Logs Applications No No Yes
296 User Access Logs (UAL) System Yes Yes Yes
297 User Folders System Yes Yes No
298 UserAssist System Yes Yes No
299 Users System Yes Yes No
300 VIPRE Logs Applications No No Yes
301 VMware Config Applications No No Yes
302 VMware Drag and Drop Files Applications No No Yes
303 VMware Logs Applications No No Yes
304 Visual Studio Team Explorer Config Applications No No Yes
305 Vivaldi Bookmarks Applications Yes Yes No
306 Vivaldi Browsing History Applications Yes Yes No
307 Vivaldi Cookies Applications Yes Yes No
308 Vivaldi Downloads Applications Yes Yes No
309 Vivaldi Extensions Applications Yes Yes No
310 Vivaldi Favicons Applications Yes Yes No
311 Vivaldi Form History Applications Yes Yes No
312 Vivaldi Local Storage Applications Yes Yes No
313 Vivaldi Login Data Applications Yes Yes No
314 Vivaldi Sessions Applications Yes Yes No
315 Vivaldi Thumbnails Applications Yes Yes No
316 Vivaldi User Profiles Applications Yes Yes No
317 Vivaldi Web Storage Applications Yes Yes No
318 Volumes Information DiskFilesystem Yes Yes No
319 WBEM System No Yes Yes
320 WMI Active Script System Yes Yes No
321 WMI Command Line System Yes Yes No
322 WSL Applications No No Yes
323 Webroot Logs Applications No No Yes
324 WhatsApp Desktop Cache Applications No No Yes
325 WhatsApp Desktop Cookie Applications No No Yes
326 WinRAR History Applications Yes Yes No
327 Windows Defender Logs Applications No No Yes
328 Windows Error Reporting Files System No No Yes
329 Windows Index Search System No Yes Yes
330 Windows Index Search Parsed System Yes Yes No
331 Windows Live Mail User Settings Applications No No Yes
332 Windows Notification History Applications No No Yes
333 Windows Timeline System Yes Yes Yes
334 Wireless Connection History Network Yes Yes No
335 WordWheelQuery System Yes Yes No
336 Xeox Logs Applications No No Yes
337 ZohoAssist Logs Applications No No Yes
338 Zoom Databases Applications No No Yes
339 Zoom Media Applications No No Yes
340 iTunes Backups Applications No No Yes