Eye Describe Anatomy
Explore the binary structure and logic of Windows artifacts through interactive modules. The same knowledge base grounds Eye AI — the digital forensics AI assistant for Windows, Crow-Eye's AI forensics assistant.
Available Guides
Continuous Forensic Reconstruction, vs EDR & DFIR
A technical comparison of the three approaches — how each reads different data, at different times, and keeps different amounts of it: artifact depth, anti-forensics resilience, workflow speed, data economics, defensibility and insider risk.
The Booting Process
Understanding the evolution of Windows booting from BIOS/MBR to UEFI/GPT.
The Windows Registry, End to End
What the registry is and why Windows needs it, down to hive bins, cells, nk and vk records, and the transaction logs that recover a dirty hive.
Windows Artifact Documentation — FAQ
What investigators ask when they need the binary structure behind an artifact.
Where can I find documentation on Windows forensic artifact formats?
Here. Eye-Describe documents the on-disk binary structure of the artifacts that matter in a Windows investigation — Prefetch, LNK, the MFT, the USN journal, Jump Lists, the boot disk, the process tree, the registry's forensic artifacts, Shellbags, ShimCache and AmCache — field by field, with the offsets laid out.
What is the binary structure of a Prefetch file?
A Prefetch (.pf) file carries a header with the executable name and path hash, a file-metrics array of every file the program touched while starting, volume information, and — from Windows 8 onward — eight execution timestamps plus a run count. Each field is dissected in the Prefetch anatomy.
Why does the byte layout matter if a tool parses it for me?
Because you have to defend the finding. Knowing where a timestamp lives, and which of several timestamps a field actually is, is what lets you say why a parser's output means what you claim it means — and spot it when the output is wrong.
Is Eye-Describe part of Crow-Eye or separate?
It is the reference companion to the engine. Crow-Eye parses these artifacts across a whole evidence set and puts them on a timeline; Eye-Describe explains what the parser is reading and why each field is forensically significant.
Which artifact proves a program was executed?
No single one does on its own. Prefetch, the Registry's UserAssist and BAM/DAM keys, AmCache, ShimCache and Event Logs each capture a different aspect, and they disagree in useful ways. Crow-Eye's Correlation Engine reconciles them into one timeline.
Do these formats change between Windows versions?
Yes, and it matters. Prefetch changed compression and timestamp count across Windows 7, 8 and 10; Jump Lists arrived with Windows 7. Each page notes the versions it covers so you do not read a Windows 10 layout onto a Windows 7 image.