Please enable JavaScript.

Coggle requires JavaScript to display documents.

TOR Forensics - Coggle Diagram

- - - - Shellbags
        
        \Users\<user profile>\AppData\Local\Microsoft\Windows\UsrClass.dat
      - Timeline Activity
        
        \Users\<user profile>\AppData\Local\Connected DevicesPlatform\L.Admin\ActivitiesCache.db
    - - Event Logs
        
        \Windows\System32\winevt\Logs\
        
        Security.evtx
        
        Application.evtx
        
        Microsoft-Windows-Security-Mitigations%4KernelMode.evtx
        
        Other Operational.evtx Files
      - UsnJrnl
        
        \$Extend\$UsnJrnl:$J
      - LNK files
        
        \Users\<user profile>\Desktop\Star Tor Browser.lnk
      - SRUM Application Resource/Network Usage
        
        \Windows\System32\sru\SRUDB.dat
      - Defender Logs
        
        \ProgramData\Microsoft\Windows Defender\Support\MPLog-<date>.log
    - - USB (SD card) Info
        
        Registry Log Files
        
        \Windows\appcompat\Programs\Amcache.hve.LOG2\
        
        \Windows\System32\Config\SOFTWARE.LOG1
        
        \Windows\System32\Config\SYSTEM.LOG2
        
        SOFTWARE
        
        Microsoft > Windows NT > CurrentVersion > EMDMgmt
        
        Microsoft > Windows Portable Devices > Devices
        
        Amcache Registry File
        
        \Windows\appcompat\Programs\Amcache.hve
        
        SYSTEM
        
        Mounted Devices
        
        ControlSet001
        
        Control
        
        DeviceClasses > several keys
        
        DeviceContainers > several keys > BaseContainers > key
        
        DeviceContainers > several keys > Properties > key
        
        Enum
        
        USBSTOR (PCISTOR)
        
        WPDBUSENUM > UMB
        
        STORAGE > VOLUME
        
        USB (PCI)
      - Tor Browser Traces
        
        NTUSER.DAT
        
        Software > Microsoft > Windows > CurrentVersion > Explorer > FeatureUsage > AppBadgeUpdated
        
        Software > Microsoft > WindowsNT > CurrentVersion > AppCompatFlags > Compatibility Assistant > Store
        
        Software > Mozilla > Firefox > Launcher
        
        Software > Microsoft > Internet Explorer > LowRegistry > Audio > PolicyConfig > PropertyStore > key
    - - SetupAPI Log
        
        \Windows\INF\setupapi.dev.log
      - Prefetch Files
        
        \Windows\prefetch\FIREFOX.EXE*.pf
        
        Other Prefetch Files - \Windows\prefetch*.pf
        
        \Windows\prefetch\TOR.EXE*.pf
    - - \%SystemDrive%\pagefile.sys
      - \%SystemDrive%\hiberfil.sys
    - - \Users\<user profile>\Downloads
  - - - Bookmarks - \Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\Places.sqlite
    - - \Tor Browser\Start Tor Browser.lnk
    - - Bookmarks - \Tor Browser\Browser\TorBrowser\Data\Browser\profile.default\Places.sqlite
    - - Tor Installed Files - \Tor Browser\
- - - - Defender Logs
        
        \ProgramData\Microsoft\Windows Defender\Support\MPLog-<date>.log
      - SRUM Application Resource/Network Usage
        
        \Windows\System32\sru\SRUDB.dat
      - Amcache Registry File
        
        \Windows\appcompat\Programs\Amcache.hve
      - Event Logs
        
        \Windows\System32\winevt\Logs\
        
        Application.evtx
        
        Microsoft-Windows-Security-Mitigations%4KernelMode.evtx
        
        Security.evtx
        
        Other Operational.evtx Files
      - NTFS Log Files
        
        \$Extend\$UsnJrnl:$J
        
        $LogFile
      - Prefetch Files
        
        \Windows\prefetch\TOR.EXE*.pf
        
        \Windows\prefetch\FIREFOX.EXE*.pf
        
        Other Prefetch Files - /Windows/prefetch/*.pf
    - - Images from Dark Web Sites, Tor Icons
      - .onion sites
    - - NTUSER.DAT
        
        Software > Microsoft > Internet Explorer > Low Registry > Property Store > key (firefox.exe)
        
        Software > Microsoft > Windows > CurrentVersion > Explorer > FeatureUsage > AppBadgeUpdated
        
        Software > Microsoft > Windows > CurrentVersion > Explorer > User/Assist > key > Count
        
        Software > Microsoft > Windows > Shell > Bags > <#> > Desktop
        
        Software > Microsoft > WindowsNT > CurrentVersion > AppCompatFlags > Compatibility Assistant > Store
        
        Software > Mozilla > Firefox > Launcher
        
        Software > Microsoft > Windows > Current Version > Explorer > Comdlg32 > MRU
      - SYSTEM
        
        ControlSet001
        
        Services > Bam > State > UserSettings > <user sid>
        
        Services > Bam > State > UserSettings > <user sid>
    - - \Users\<user profile>\Downloads
    - - Tor Browser Download - \Users\<user profile>\AppData\Local\<browser dependent>
    - - \%SystemDrive%\pagefile.sys
      - \%SystemDrive%\hiberfil.sys
    - - \$Recycle.Bin
  - - - Tor Browser Install Location - \Users\<user profile>\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
      - Tor Browser Download - \Users\<user profile>\AppData\Local\<browser dependent>
    - - LNK files
        
        \Users\<user profile>\Desktop\Star Tor Browser.lnk
      - Amcache Registry File
        
        Windows\appcompat\Programs\Amcache.hve
      - Defender Logs
        
        \ProgramData\Microsoft\Windows Defender\Support\MPLog-<date>.log
      - Event Logs
        
        \Windows\System32\winevt\Logs\
        
        Application.evtx
        
        Security.evtx
        
        Microsoft-Windows-Security-Mitigations%4KernelMode.evtx
        
        Other Operational.evtx Files
      - NTFS Log Files
        
        \$Extend\$UsnJrnl:$J
        
        $LogFile
      - Prefetch Files
        
        \Windows\prefetch\FIREFOX.EXE*.pf
        
        Other Prefetch Files - \Windows\prefetch*.pf
        
        \Windows\prefetch\TOR.EXE*.pf
      - SRUM Application Resource/Network Usage
        
        \Windows\System32\sru\SRUDB.dat
    - - Firefox Add-ons - \Users\<user profile>\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default/extensions.json
      - Bookmarks - \Users\<user profile>\Desktop\Tor Browser\Browser\TorBrowser\Data\Browser\profile.default/places.sqlite
      - \%SystemDrive%\hiberfil.sys
      - \%SystemDrive%\pagefile.sys
    - - \Users\<user profile>\AppData\Local\Connected DevicesPlatform\L.Admin\ActivitiesCache.db
    - - \Users\<user profile>\Downloads
    - - SYSTEM
        
        ControlSet001
        
        Control > Session Manager > AppCompatCache
        
        Services > Bam > State > UserSettings > <user sid>
      - NTUSER.DAT
        
        Software > Microsoft > Internet Explorer > Low Registry > Property Store > key (firefox.exe)
        
        Software > Microsoft > Windows > CurrentVersion > Explorer > FeatureUsage > AppBadgeUpdated
        
        Software > Microsoft > Windows > CurrentVersion > Explorer > User/Assist > key > Count
        
        Software > Microsoft > Windows > Shell > Bags > <#> > Desktop
        
        Software > Microsoft > WindowsNT > CurrentVersion > AppCompatFlags > Compatibility Assistant > Store
        
        Software > Mozilla > Firefox > Launcher
        
        Software > Microsoft > Windows > Current Version > Explorer > Comdlg32 > MRU
    - - Images from Dark Web Sites, Tor Icons
      - .onion sites