Windows Incident Response
Harlan Carvey
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
Harlan Carvey's long-running blog on Windows incident response, registry analysis, investigative methodology and the discipline of documenting how you reached a conclusion.
Who it is for, and when
The methodology posts are the valuable part: how to build a timeline from multiple artifact sources, how to avoid single-artifact conclusions, how to record analysis so someone else can reproduce it. That reasoning transfers directly to expert work even though the examples are Windows. Publishing intermittently — most recent post 1 January 2026, so check the date before treating tool commentary as current.
What it does not cover
It is Windows-centric: very little on mobile, macOS or cloud, and nothing on the mechanics of testimony or disclosure.
Go to the source
Open at windowsir.blogspot.com (opens in a new tab)https://windowsir.blogspot.com/
Details
- Type
- Blog or channel
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Harlan Carvey
- Topics
- windows, registry, timeline, incident-response, threat-hunting
- Checked at source
Related entries
A large collection of free single-purpose Windows artefact parsers — among them MFTECmd, PECmd, LECmd, JLECmd, AmcacheParser, SBECmd, EvtxECmd, RECmd, and the Timeline Explorer and Registry Explorer GUIs. The tools are still distributed from ericzimmerman.github.io, with a Get-ZimmermanTools helper that pulls the current set.
Two open-source Rust tools that apply Sigma and their own rules directly to Windows event log (EVTX) files and produce a prioritised, timeline-ordered set of hits. Hayabusa comes from Yamato Security; Chainsaw is published by WithSecure (the repository now lives under WithSecureOpenSource). Both are actively released.
An open-source Python framework that extracts timestamps from hundreds of artefact types across a disk image or directory and writes them into a single normalised storage file. log2timeline is the extraction front end; psort and psteal filter, sort, and export the result.
A download library of reference posters and cheat sheets, of which 37 are filed under Digital Forensics and Incident Response — artifact maps, timestamp reference tables, tool command references and filter syntax sheets. Download requires a free SANS account rather than payment.
Sigma
FreeAn open, structured YAML format for describing detections in log data, plus a community rule repository and the pySigma/sigma-cli tooling that converts a rule into the query language of a particular SIEM or log platform. The rule repository is actively released by SigmaHQ.