Miscellaneous Beginner PC Checks

[wimbur]

Shellbags deletion​

Cleaning ShellBags
ShellBags are a fairly useful source of artifacts if you need to view which folders a suspect used and visited; however, they can erase this data.

Most often, this is done via ShellBagAnalyzerCleaner.

How to detect it?

Check in Everything and JournalTrace the history of interactions with the file shellbag_analyzer_cleaner.inithis is a file that is automatically created during cleaning via this program.

The modification date of the file is the date of the cleaning.

Checking via JournalTrace is extremely important, since the user may rename this file or delete it.

RecycleBin​

Clearing the recycle bin is the simplest but no less common way to try to hide cheats.

It can be detected through the $Recycle.Bin system folder, which is located on every PC drive.

To access it, you need to enable system and hidden files

Once you have navigated to this folder, check the date of the “Recycle Bin” shortcut change, which will be the date of deletion

Journal Trace Deletion​

Cleaning JournalTrace
This utility uses the USN log, which records virtually any file manipulation (opening, modification, deletion). Cleaning this log is an unconditional reason for punishment.

How to detect it?​

1. If the FSUTIL.EXE command was detected in Prefetch shortly before the check
2. In EventViewer, go to Applications and filter events by code 3079. The records found indicate that the log has been cleaned and also provide the specific date when this occurred.

Cleaning USB devices​

USBOblivion is a portable utility for Windows designed to clean traces of USB device connections (flash drives, disks, phones, etc.) from the registry and system history.

Methods of detection:

1. Check the history of this program through the USN log. (Renaming, opening, deleting)
2. You can also check the program's storage via the DPS process in System Informer using these lines:

2021/11/29:17:36:29
2021/11/29:17:36:22!22

3. This program clears registry keys in these paths:

HKLM\SYSTEM\CurrentControlSet\Enum\USB

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses

HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR

4. The program launch can be found through other artifact sources that log the launch of .exe files.

Clearing Event Log​

Users can clear EventViewer entries, which store many extremely important logs: disk disconnections, USN cleanup, activation of overkill scripts, and much more, so it is extremely important to check this.

To check, you need to:​

1) Win+R - Eventvwr
2) Select the “Security” section
3) Filter by ID 1102

The record found will indicate that a log has been cleared.

Its modification date will be the date of clearing.

Second method

We can also check log clearing via ID 104 in the “System” section.

Clearing the registry​

Users can clean registry keys in different ways: manually, by accessing the registry, or by using commands such as reg delete.

To detect them, we will use the Registry Explorer program.
You can download it from this website:

You must be registered for see links

The program has a lot of features, so we recommend that you familiarize yourself with it by reading the manual, which will be automatically downloaded in the archive.

Instructions for checking deleted keys:​

Be sure to run it as an administrator.

In the upper left corner, click File - Live System - load either the section we need (SYSTEM, SAM, etc.) or Users - NTUSER.dat.

We can view the sections:

Unassociated deleted values and Associated delete values to try to find some deleted keys or entire sections. You can also simply search for the sections you need and conveniently view them.

Each section also has a modification date, which can help you determine possible cleaning or any other manipulations (by default, it is displayed in the UTC time zone, please note).

You can also check whether records have been deleted by looking at the modification date.

The modification date of the section itself does not coincide with the modification date of the last key, conditionally.

My sincere apologies if this post is not up to par with what i usually post but im trying to help the new people out​