Windows Forensics: Top 20 Locations to check in the disk file for windows

This guide is your roadmap to finding hidden flags in Windows systems during CTF competitions and digital forensic investigations. We'll cover the top 20 locations where flags…

Updated February 12, 20266 min readSource on GitHub (opens in a new tab)

By Anas Education

Introduction#

This guide is your roadmap to finding hidden flags in Windows systems during CTF competitions and digital forensic investigations. We'll cover the top 20 locations where flags are commonly hidden, from the obvious to the obscure.

🔍 Section 1: Essential Locations (1-10)#

1. The PowerShell History#

This is often the Gold Mine in CTFs. If the user executed commands to hide a file, download a payload, or echo a flag, it will be recorded here.

📂 Location:

text

[root]\Users\[Username]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

🔎 What to look for:

Base64 encoded strings (e.g., echo "ZmxhZ3s...")
File paths to hidden directories
wget or curl commands

2. Web Browser Data (History & Downloads)#

Browsers store a massive amount of data. Flags are often split inside URLs or found in the list of downloaded files.

📂 Location (Chrome/Edge):

text

[root]\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\

📄 Key Files:

History - Search queries, visited URLs
Login Data - Saved passwords (often the flag is a password!)
Cookies - Session tokens

💡 Tip: Use tools like BrowsingHistoryView or DB Browser for SQLite to read these files.

3. The User's "Downloads" & "Desktop"#

The most obvious place is often the correct one. CTF creators expect you to look here for "dropped" files.

📂 Locations:

text

[root]\Users\[Username]\Downloads\
[root]\Users\[Username]\Desktop\
[root]\Users\[Username]\Documents\

🔎 What to look for:

Suspicious images (check for Steganography)
Archive files (.zip, .7z, .rar)
Text files (notes.txt, passwords.txt)

4. The Recycle Bin ($Recycle.Bin)#

Users often delete the flag or evidence thinking it's gone. In Windows, deleted files move to a hidden system folder.

📂 Location:

text

[root]\$Recycle.Bin\[User SID]\

🔎 What to look for:

Two types of files exist for every deleted item:

$R... - The actual content of the deleted file (The Flag!)
$I... - Metadata (original filename, deletion date)

5. Recent Files (LNK Files)#

Even if a file was deleted and wiped, Windows keeps a "shortcut" (LNK file) pointing to it if it was recently opened.

📂 Location:

text

[root]\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent\

🔎 What to look for:

Filenames that look like flags
Paths to USB drives (e.g., E:\flag.txt)

6. Windows Registry (Run Keys & User Info)#

The registry is a database of configuration settings. Flags can be hidden as "values" or "keys".

📂 Locations:

text

[root]\Windows\System32\config\SOFTWARE
[root]\Users\[Username]\NTUSER.DAT

🔑 Key Paths to Check:

Auto-Run programs: Software\Microsoft\Windows\CurrentVersion\Run
User Environment: Environment (Look for variables named FLAG)

7. Alternate Data Streams (ADS)#

This is a feature of the NTFS file system that allows data to be hidden behind a file. The file looks normal (0 KB or normal size), but has hidden data attached.

📂 Location:

Any file, but commonly in Downloads or Temp

🔍 How to detect:

In Command Line: dir /r
In PowerShell: Get-Item -Path file.txt -Stream *

💡 Scenario: A file named image.jpg might have a hidden stream image.jpg:flag.txt

8. Windows Prefetch#

Prefetch files are created when an application is executed. They prove what tools the user ran.

📂 Location:

text

[root]\Windows\Prefetch\

🔎 What to look for:

Evidence of Steganography tools: OPENSTEGO.EXE, STEGHIDE.EXE
Evidence of Archiving tools: WINRAR.EXE, 7Z.EXE

💡 Tip: If you see STEGHIDE.EXE in Prefetch, you know you need to look for an image file with a hidden password!

9. Temp Folders (%TEMP%)#

Malware and installation scripts often unpack data to the Temp folder and leave it there.

📂 Location:

text

[root]\Users\[Username]\AppData\Local\Temp\

🔎 What to look for:

Text files generated by scripts
Leftover installation logs
Temporary flag files

10. System Environment Variables#

Sometimes, the flag is not a file, but a system variable set by the administrator.

📂 Location (via Registry):

Load the SYSTEM hive: ControlSet001\Control\Session Manager\Environment

🔎 What to look for:

Keys named CTF_FLAG, SECRET, or PASSWORD

🔐 Section 2: Advanced Locations (11-20)#

11. SAM & SYSTEM Hives (User Passwords)#

This is the most critical location for credential theft. Windows does not store user passwords in cleartext; it stores them as NTLM hashes in the SAM file. To crack them, you need both the SAM and SYSTEM files.

📂 Locations:

text

[root]\Windows\System32\config\SAM
[root]\Windows\System32\config\SYSTEM

🛠️ What to do:

Extract both files
Use tools like samdump2 or secretsdump.py (Impacket) to extract the hashes

python3 secretsdump.py -sam SAM -system SYSTEM LOCAL or samdump2 SYSTEM SAM 3. Crack the hashes using Hashcat or John the Ripper 4. The flag might be the user's password!

Security Questions FOR recupering the password

we have a tool : Analyze with Nirsoft SecurityQuestionsView in windows link : https://www.nirsoft.net/utils/security_questions_view.html (opens in a new tab) in linux we have sudo apt install wine wget https://www.nirsoft.net/utils/securityquestionsview.zip (opens in a new tab) unzip securityquestionsview.zip wine SecurityQuestionsView.exe#

12. Registry Backups (RegBack)#

If the main registry hives are corrupted or the user deleted a key recently, check the automatic backups.

📂 Location:

text

[root]\Windows\System32\config\RegBack\

🔎 What to look for:

Copies of SAM, SYSTEM, SOFTWARE, etc.
Compare these backups with the current hives to see what changed (Diffing)

13. Volume Shadow Copies (VSS)#

Windows automatically creates "snapshots" of the system (Restore Points). This allows you to travel back in time and view files as they existed days or weeks ago.

💡 Concept:

Even if a file was "securely deleted" today, a copy might exist in a Shadow Copy from yesterday.

🔍 How to access:

In forensic tools (like Autopsy or FTK Imager), look for "Shadow Copies" or "VSS"
Mount the shadow copy and browse the filesystem as if it were that previous date

14. Pagefile.sys & Hiberfil.sys (Disk Memory)#

These files act as an extension of the RAM (Random Access Memory). They contain data that was in the computer's memory when it hibernated or ran out of RAM.

📂 Locations:

text

[root]\pagefile.sys
[root]\hiberfil.sys

🔎 What to look for:

Strings Analysis: Since you can't open these like normal files, run strings or grep on them
Look for passwords, clipboard contents, or decoded flags that were only ever in memory

15. Windows Event Logs (.evtx)#

Logs record everything. In CTFs, specific logs are gold mines.

📂 Location:

text

[root]\Windows\System32\winevt\Logs\

📄 Key Logs to Check:

Security.evtx: Look for Event ID 4624 (Logon) or 4625 (Failed Logon)
Microsoft-Windows-PowerShell%4Operational.evtx: Look for Event ID 4104 (Script Block Logging). This often captures the full content of a PowerShell script, even if the script file was deleted!

16. Thumbcache (Deleted Images)#

If the user viewed a picture (like flag.jpg) and then deleted it, Windows keeps a thumbnail of it to show in File Explorer.

📂 Location:

text

[root]\Users\[Username]\AppData\Local\Microsoft\Windows\Explorer\

📄 Files: thumbcache_xxx.db

🛠️ Tool: Use Thumbcache Viewer. You might find a low-resolution version of the flag here.

17. Amcache & ShimCache (Program Execution)#

These artifacts prove that a specific program was executed, even if the program itself is gone.

📂 Locations:

Amcache: [root]\Windows\appcompat\Programs\Amcache.hve
ShimCache: In the Registry (SYSTEM hive)

🔎 What to look for:

Paths to executables that no longer exist (e.g., C:\Temp\malware_flag_generator.exe)

18. USB Device History (Registry)#

Did the user plug in a USB drive? The registry tracks every device ever connected.

📂 Location:

Registry Hive: SYSTEM

Path: ControlSet001\Enum\USBSTOR

🔎 What to look for:

Names of USB sticks (e.g., "Sandisk", "Kingston")
Serial numbers
Sometimes the Volume Name itself is the hint or part of the flag

19. Sticky Notes#

Users love to write down passwords and reminders in Sticky Notes.

📂 Location (Windows 10+):

text

[root]\Users\[Username]\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

🛠️ What to do:

Open this SQLite database and browse the Note table for text.

20. Windows Timeline (ActivitiesCache)#

This feature (Win + Tab) tracks what the user was doing across their devices.

📂 Location:

text

[root]\Users\[Username]\AppData\Local\ConnectedDevicesPlatform\L.[User]\ActivitiesCache.db

🔎 What to look for:

Text regarding opened documents
URLs visited
Copy-paste activities

Created by Anas Education

Last Updated: 2026

Windows Forensics: Top 20 Locations to check in the disk file for windows

This guide is your roadmap to finding hidden flags in Windows systems during CTF competitions and digital forensic investigations. We'll cover the top 20 locations where flags…

Updated February 12, 20266 min readSource on GitHub (opens in a new tab)

By Anas Education

Introduction#

🔍 Section 1: Essential Locations (1-10)#

1. The PowerShell History#

This is often the Gold Mine in CTFs. If the user executed commands to hide a file, download a payload, or echo a flag, it will be recorded here.

📂 Location:

text

[root]\Users\[Username]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

🔎 What to look for:

Base64 encoded strings (e.g., echo "ZmxhZ3s...")
File paths to hidden directories
wget or curl commands

2. Web Browser Data (History & Downloads)#

Browsers store a massive amount of data. Flags are often split inside URLs or found in the list of downloaded files.

📂 Location (Chrome/Edge):

text

[root]\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\

📄 Key Files:

History - Search queries, visited URLs
Login Data - Saved passwords (often the flag is a password!)
Cookies - Session tokens

💡 Tip: Use tools like BrowsingHistoryView or DB Browser for SQLite to read these files.

3. The User's "Downloads" & "Desktop"#

The most obvious place is often the correct one. CTF creators expect you to look here for "dropped" files.

📂 Locations:

text

[root]\Users\[Username]\Downloads\
[root]\Users\[Username]\Desktop\
[root]\Users\[Username]\Documents\

🔎 What to look for:

Suspicious images (check for Steganography)
Archive files (.zip, .7z, .rar)
Text files (notes.txt, passwords.txt)

4. The Recycle Bin ($Recycle.Bin)#

Users often delete the flag or evidence thinking it's gone. In Windows, deleted files move to a hidden system folder.

📂 Location:

text

[root]\$Recycle.Bin\[User SID]\

🔎 What to look for:

Two types of files exist for every deleted item:

$R... - The actual content of the deleted file (The Flag!)
$I... - Metadata (original filename, deletion date)

5. Recent Files (LNK Files)#

Even if a file was deleted and wiped, Windows keeps a "shortcut" (LNK file) pointing to it if it was recently opened.

📂 Location:

text

[root]\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent\

🔎 What to look for:

Filenames that look like flags
Paths to USB drives (e.g., E:\flag.txt)

6. Windows Registry (Run Keys & User Info)#

The registry is a database of configuration settings. Flags can be hidden as "values" or "keys".

📂 Locations:

text

[root]\Windows\System32\config\SOFTWARE
[root]\Users\[Username]\NTUSER.DAT

🔑 Key Paths to Check:

Auto-Run programs: Software\Microsoft\Windows\CurrentVersion\Run
User Environment: Environment (Look for variables named FLAG)

7. Alternate Data Streams (ADS)#

This is a feature of the NTFS file system that allows data to be hidden behind a file. The file looks normal (0 KB or normal size), but has hidden data attached.

📂 Location:

Any file, but commonly in Downloads or Temp

🔍 How to detect:

In Command Line: dir /r
In PowerShell: Get-Item -Path file.txt -Stream *

💡 Scenario: A file named image.jpg might have a hidden stream image.jpg:flag.txt

8. Windows Prefetch#

Prefetch files are created when an application is executed. They prove what tools the user ran.

📂 Location:

text

[root]\Windows\Prefetch\

🔎 What to look for:

Evidence of Steganography tools: OPENSTEGO.EXE, STEGHIDE.EXE
Evidence of Archiving tools: WINRAR.EXE, 7Z.EXE

💡 Tip: If you see STEGHIDE.EXE in Prefetch, you know you need to look for an image file with a hidden password!

9. Temp Folders (%TEMP%)#

Malware and installation scripts often unpack data to the Temp folder and leave it there.

📂 Location:

text

[root]\Users\[Username]\AppData\Local\Temp\

🔎 What to look for:

Text files generated by scripts
Leftover installation logs
Temporary flag files

10. System Environment Variables#

Sometimes, the flag is not a file, but a system variable set by the administrator.

📂 Location (via Registry):

Load the SYSTEM hive: ControlSet001\Control\Session Manager\Environment

🔎 What to look for:

Keys named CTF_FLAG, SECRET, or PASSWORD

🔐 Section 2: Advanced Locations (11-20)#

11. SAM & SYSTEM Hives (User Passwords)#

📂 Locations:

text

[root]\Windows\System32\config\SAM
[root]\Windows\System32\config\SYSTEM

🛠️ What to do:

Extract both files
Use tools like samdump2 or secretsdump.py (Impacket) to extract the hashes

python3 secretsdump.py -sam SAM -system SYSTEM LOCAL or samdump2 SYSTEM SAM 3. Crack the hashes using Hashcat or John the Ripper 4. The flag might be the user's password!

Security Questions FOR recupering the password

we have a tool : Analyze with Nirsoft SecurityQuestionsView in windows link : https://www.nirsoft.net/utils/security_questions_view.html (opens in a new tab) in linux we have sudo apt install wine wget https://www.nirsoft.net/utils/securityquestionsview.zip (opens in a new tab) unzip securityquestionsview.zip wine SecurityQuestionsView.exe#

12. Registry Backups (RegBack)#

If the main registry hives are corrupted or the user deleted a key recently, check the automatic backups.

📂 Location:

text

[root]\Windows\System32\config\RegBack\

🔎 What to look for:

Copies of SAM, SYSTEM, SOFTWARE, etc.
Compare these backups with the current hives to see what changed (Diffing)

13. Volume Shadow Copies (VSS)#

Windows automatically creates "snapshots" of the system (Restore Points). This allows you to travel back in time and view files as they existed days or weeks ago.

💡 Concept:

Even if a file was "securely deleted" today, a copy might exist in a Shadow Copy from yesterday.

🔍 How to access:

In forensic tools (like Autopsy or FTK Imager), look for "Shadow Copies" or "VSS"
Mount the shadow copy and browse the filesystem as if it were that previous date

14. Pagefile.sys & Hiberfil.sys (Disk Memory)#

These files act as an extension of the RAM (Random Access Memory). They contain data that was in the computer's memory when it hibernated or ran out of RAM.

📂 Locations:

text

[root]\pagefile.sys
[root]\hiberfil.sys

🔎 What to look for:

Strings Analysis: Since you can't open these like normal files, run strings or grep on them
Look for passwords, clipboard contents, or decoded flags that were only ever in memory

15. Windows Event Logs (.evtx)#

Logs record everything. In CTFs, specific logs are gold mines.

📂 Location:

text

[root]\Windows\System32\winevt\Logs\

📄 Key Logs to Check:

Security.evtx: Look for Event ID 4624 (Logon) or 4625 (Failed Logon)
Microsoft-Windows-PowerShell%4Operational.evtx: Look for Event ID 4104 (Script Block Logging). This often captures the full content of a PowerShell script, even if the script file was deleted!

16. Thumbcache (Deleted Images)#

If the user viewed a picture (like flag.jpg) and then deleted it, Windows keeps a thumbnail of it to show in File Explorer.

📂 Location:

text

[root]\Users\[Username]\AppData\Local\Microsoft\Windows\Explorer\

📄 Files: thumbcache_xxx.db

🛠️ Tool: Use Thumbcache Viewer. You might find a low-resolution version of the flag here.

17. Amcache & ShimCache (Program Execution)#

These artifacts prove that a specific program was executed, even if the program itself is gone.

📂 Locations:

Amcache: [root]\Windows\appcompat\Programs\Amcache.hve
ShimCache: In the Registry (SYSTEM hive)

🔎 What to look for:

Paths to executables that no longer exist (e.g., C:\Temp\malware_flag_generator.exe)

18. USB Device History (Registry)#

Did the user plug in a USB drive? The registry tracks every device ever connected.

📂 Location:

Registry Hive: SYSTEM

Path: ControlSet001\Enum\USBSTOR

🔎 What to look for:

Names of USB sticks (e.g., "Sandisk", "Kingston")
Serial numbers
Sometimes the Volume Name itself is the hint or part of the flag

19. Sticky Notes#

Users love to write down passwords and reminders in Sticky Notes.

📂 Location (Windows 10+):

text

[root]\Users\[Username]\AppData\Local\Packages\Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe\LocalState\plum.sqlite

🛠️ What to do:

Open this SQLite database and browse the Note table for text.

20. Windows Timeline (ActivitiesCache)#

This feature (Win + Tab) tracks what the user was doing across their devices.

📂 Location:

text

[root]\Users\[Username]\AppData\Local\ConnectedDevicesPlatform\L.[User]\ActivitiesCache.db

🔎 What to look for:

Text regarding opened documents
URLs visited
Copy-paste activities

Created by Anas Education

Last Updated: 2026

Introduction#

🔍 Section 1: Essential Locations (1-10)#

1. The PowerShell History#

2. Web Browser Data (History & Downloads)#

3. The User's "Downloads" & "Desktop"#

4. The Recycle Bin ($Recycle.Bin)#

5. Recent Files (LNK Files)#

6. Windows Registry (Run Keys & User Info)#

7. Alternate Data Streams (ADS)#

8. Windows Prefetch#

9. Temp Folders (%TEMP%)#

10. System Environment Variables#

🔐 Section 2: Advanced Locations (11-20)#

11. SAM & SYSTEM Hives (User Passwords)#

12. Registry Backups (RegBack)#

13. Volume Shadow Copies (VSS)#

14. Pagefile.sys & Hiberfil.sys (Disk Memory)#

15. Windows Event Logs (.evtx)#

16. Thumbcache (Deleted Images)#

17. Amcache & ShimCache (Program Execution)#

18. USB Device History (Registry)#

19. Sticky Notes#

20. Windows Timeline (ActivitiesCache)#

Related notes

Introduction#

🔍 Section 1: Essential Locations (1-10)#

1. The PowerShell History#

2. Web Browser Data (History & Downloads)#

3. The User's "Downloads" & "Desktop"#

4. The Recycle Bin ($Recycle.Bin)#

5. Recent Files (LNK Files)#

6. Windows Registry (Run Keys & User Info)#

7. Alternate Data Streams (ADS)#

8. Windows Prefetch#

9. Temp Folders (%TEMP%)#

10. System Environment Variables#

🔐 Section 2: Advanced Locations (11-20)#

11. SAM & SYSTEM Hives (User Passwords)#

12. Registry Backups (RegBack)#

13. Volume Shadow Copies (VSS)#

14. Pagefile.sys & Hiberfil.sys (Disk Memory)#

15. Windows Event Logs (.evtx)#

16. Thumbcache (Deleted Images)#

17. Amcache & ShimCache (Program Execution)#

18. USB Device History (Registry)#

19. Sticky Notes#

20. Windows Timeline (ActivitiesCache)#

Related notes