A subject deletes a shadow copy on a Windows system. This may represent an anti-forensics technique where the intent is to deny access to artifacts of investigative value that may be stored within the shadow copy.

The subject intentionally misclassifies the sensitivity label of a file in an attempt to bypass DLP or other security controls.

MountPoints2 is a Windows Registry key used to store information about previously connected removable devices, such as USB drives, CDs, and other external storage media. It is located at:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 Each subkey under MountPoints2 represents a unique device, often identified by its GUID (Globally Unique Identifier) or other unique identifier.These subkeys can contain various values that describe the properties and behavior of the corresponding device, such as the assigned drive letter, volume label, and other relevant data.

MFT Entry Number Sequence Irregularities refer to inconsistencies where the sequential order of Master File Table (MFT) entries in an NTFS file system does not align with the chronological order of file timestamps. Such irregularities can indicate potential file manipulation or tampering, such as timestamping, where timestamps are altered to obscure the true timeline of file creation or modification.

If multiple files have suspiciously aligned creation or modification times or identical timestamps but different entry numbers, this might indicate that the timestamps were manually set to specific values rather than being naturally generated by the system.

By extracting and comparing timestamps from MFT and Shimcache, it is possible to identify inconsistencies that could represent timestomping in relation to executable files. The Application Compatibility Cache (referred to as Shimcache) records a value for the Last Modified Time when an executable file is last run. The Master File Table (MFT) contains information about every file and directory on an NTFS volume. Each file or directory is represented by an MFT entry, which stores metadata about the file, including modified, accessed, and created timestamps. If the Shimcache timestamp indicates a file was run at a certain time but the MFT shows a different or much later modification timestamp, this would be considered unexpected.