Eye Describe Anatomy
Explore the binary structure and logic of Windows artifacts through interactive modules. The same knowledge base grounds Eye AI — the digital forensics AI assistant for Windows, Crow-Eye's AI forensics assistant.
Windows Artifact Documentation — FAQ
What investigators ask when they need the binary structure behind an artifact.
Where can I find documentation on Windows forensic artifact formats?
Here. Eye-Describe documents the on-disk binary structure of the artifacts that matter in a Windows investigation — Prefetch, LNK, the MFT, the USN journal, Jump Lists, the boot disk and the process tree — field by field, with the offsets laid out.
What is the binary structure of a Prefetch file?
A Prefetch (.pf) file carries a header with the executable name and path hash, a file-metrics array of every file the program touched while starting, volume information, and — from Windows 8 onward — eight execution timestamps plus a run count. Each field is dissected in the Prefetch anatomy.
Why does the byte layout matter if a tool parses it for me?
Because you have to defend the finding. Knowing where a timestamp lives, and which of several timestamps a field actually is, is what lets you say why a parser's output means what you claim it means — and spot it when the output is wrong.
Is Eye-Describe part of Crow-Eye or separate?
It is the reference companion to the engine. Crow-Eye parses these artifacts across a whole evidence set and puts them on a timeline; Eye-Describe explains what the parser is reading and why each field is forensically significant.
Which artifact proves a program was executed?
No single one does on its own. Prefetch, the Registry's UserAssist and BAM/DAM keys, AmCache, ShimCache and Event Logs each capture a different aspect, and they disagree in useful ways. Crow-Eye's Correlation Engine reconciles them into one timeline.
Do these formats change between Windows versions?
Yes, and it matters. Prefetch changed compression and timestamp count across Windows 7, 8 and 10; Jump Lists arrived with Windows 7. Each page notes the versions it covers so you do not read a Windows 10 layout onto a Windows 7 image.