Autopsy: browser, downloads, and the traces a person leaves

Each store has a job

The recent-activity ingest reads artifacts the operating system and common browsers write for themselves: history databases, download lists, link files, jump lists, and similar records. They are not a video of the screen. A history row can mean the browser recorded a visit. A download row can mean the browser recorded a finished download, including the target path and a time. A link file can mean something was opened in a way that created a shortcut in Recent. When a store is missing, say the store is missing. Emptiness has causes that include a profile you have not found, a browser you did not parse, and a person who uses a tool that never writes that database.

Start from the account. On NL-FIN-14 the question is NORTHLINE\avery, so the profile paths under C:\Users\avery are the first place those databases should appear. A second profile, a temporary user, or a browser installed under AppData changes where you look. The module will often list what it parsed. If your keyword was only in the system profile, you have a different user and you should say so.

History and downloads answer different questions

History is a list of URLs the browser chose to remember, with visit times. Downloads are a list of files it thinks it saved, often with a source URL, a target path, and a start or end time. A file can be on disk with no download row, because it was copied from a share, saved from mail, or created by a script. A download row can exist after the file was deleted. You check both, and you let them disagree in the notes until you have a reason they fit.

A URL in history is a lead to a host. In this case you care whether drop.lab.example or the address 203.0.113.44 appears. If it does, record the browser, the profile path, the time, and the full URL the database stored. If it does not, record that you looked in the parsed history for that profile. Mail clients, desktop sync tools, and a script will not leave a browser history row. The absence belongs in the timeline as a negative only for the stores you actually parsed.

• Browser and profile path.
• Row type: visit, download, or cache, if the module distinguishes them.
• Time, with the case timezone.
• URL or target path, copied from the artifact.
• Whether the target file is still on disk, and its hash if it is.

Windows remembers opens, links, and devices

Link files in Recent, jump lists, and the registry keys that track recent documents are Windows telling itself what to show in a menu. They can reveal that a workbook was opened, and they can linger after a delete. Prefetch, when it exists, records that an executable ran often enough for Windows to cache it, with a rough time. It is a hint about execution, and it is a poor substitute for a process log. Use it to decide whether powershell.exe or a strange binary is worth finding in Sysmon, and keep the Prefetch time labeled as Prefetch.

USB and other devices show up in setup logs and registry keys the operating system uses for drivers. A new storage device on the morning of the copy is relevant to “how did the file leave.” A device last seen months ago is context, and it can stay in a short list. Write the device identifier, the first and last times the artifact actually stores, and the key or log path. A friendly volume name is a label. The serial, when the artifact has one, is the identifier you can compare to another machine.

What this layer will not settle

User-activity artifacts are local records. They do not show the bytes on the wire, the remote server’s view, or the contents of an encrypted blob you have not decoded. They also sit in files that a program running as the user can edit. When a store looks truncated, note the condition and corroborate with the filesystem times on the database file itself, and with Sysmon if you have it. Corroboration is another artifact agreeing on the path and the window. One store, alone, is still just that store.

Bring the rows you trust back onto the timeline. A download at 09:12, a link file at 09:16, and a Temp file at 09:18 can be three sources for one window. Write them as three sources. The story gets stronger because they are independent, and it stays honest because you did not merge them into a single imaginary event.

Worked case: a Temp file the browser did not download

Recent activity for Avery’s Edge profile has a 09:12 download row for the Documents name, Payroll-April.xlsx, which sits next to that file’s $FILE_NAME time. It has no download row for p4.xlsx and no visit to drop.lab.example between 08:30 and 10:00. It also has ordinary mailbox visits earlier in the morning. The Documents workbook has a link file in Recent at 09:16. Prefetch shows powershell.exe ran that morning, and the Prefetch time falls inside the same window, labeled as Prefetch and not as a command line.

You write that the Temp copy is not explained by the parsed Edge download list. The link file supports the workbook being opened around 09:16. The way p4.xlsx was created is still open, and it is the question you take to the Sysmon export and, if needed, to memory. You do not fill the gap with a guess about a cleared history.