🪷
RedLotus Guide
  • ScreenSharing Introducttion and Principles
    • Introduction
      • What is a Hack Check (Screenshare)?
      • The Goal: Demonstrating Cheat Usage
      • The Staffer's Perspective and the Learning Process
    • Red Lotus Principles
      • Red Lotus Principles for Ethical and Effective ScreenSharing
      • Requirements for ScreenSharers
      • ScreenSharing Protocols (Video Recording)
      • Anti-Corruption Measures
  • ScreenSharing General Knowledge
    • Windows Fundamentals
      • File Systems: The Foundation
        • File System (Definition, Types: NTFS, FAT32, etc.)
        • Journaling (Definition, Purpose)
      • Fundamental Timestamps
      • Key NTFS Components
        • Master File Table ($MFT) - The File Catalog
        • The Journal ($USNJrnl) - The Change Log
        • $LogFile (Metadata Log) - Specific Log for Metadata Changes
        • Alternate Data Streams (ADS) - Hidden Data Streams
        • File Attributes (Read-Only, Hidden, etc.) - Manipulable Properties
    • Common Windows Artifacts and Their Basic Analysis
      • Execution Traces and Recent Activity
        • Prefetch ( C:\Windows\Prefetch )
        • Temporary Files ( %temp% )
        • Recent Items ( shell:recent )
        • Recycle Bin ( C:$Recycle.bin )
      • Other Notable Folders/Locations
      • Windows Registry: Introduction
        • Registry Structure: Hives, Keys, and Values
        • Registry Value Types (Brief Overview)
      • Windows Event Logs: Introduction
        • Event Log Structure ( .evtx Files)
        • The EventLog Service
        • Event Viewer ( eventvwr.msc )
    • Manual SS Techniques (Basic and Intermediate)
      • Introduction to Process and Memory Analysis
      • Process Hacker / System Informer: Introduction and Configuration
        • Key Capabilities for ScreenSharing:
        • Configuration: Enabling Kernel Mode Driver
        • General Process Filtering Steps:
      • Specific Processes to Analyze and Search Patterns
        • explorer.exe (Windows Explorer)
        • csrss.exe (Client Server Runtime Subsystem)
        • PlugPlay Service (Sometimes shown under DCOMLaunch)
        • svchost.exe (-s dps) (Diagnostic Policy Service)
        • PcaSvc (Program Compatibility Assistant Service)
        • Other Relevant Processes
      • Windows Prefetch Analysis (WinPrefetchView / PECmd)
        • Understanding Prefetch
        • Information Stored in Prefetch Files
        • Analysis Tools
        • Troubleshooting and Evasion Detection
      • LastActivityView: Artifact Aggregation
        • Data Sources
        • Functionality in ScreenSharing
        • Limitations and Considerations
      • Search Everything: Rapid File System Search
        • Core Features
        • Usage in ScreenSharing
      • Journal Analysis (JournalTrace / Echo Easy Journal Viewer)
        • The USN Journal ( $UsnJrnl )
        • GUI Parsing Tools
        • Application in ScreenSharing
        • Limitations
      • Regedit / Registry Explorer (Registry Viewers - Basic Usage)
        • Understanding the Windows Registry
        • Accessing the Registry
        • Forensically Relevant Registry Keys/Locations
        • Key Considerations for ScreenSharing
      • Event Viewer (Basic Usage for Common IDs)
        • Understanding Event Viewer
        • Accessing Event Viewer
        • Log Storage
        • Checking the EventLog Service
        • Key Event Logs and IDs for ScreenSharing
        • Key Considerations for ScreenSharing
      • Recuva (Deleted File Recovery)
        • Understanding Recuva
        • Usage in ScreenSharing
        • Limitations
    • More Artifact Analysis for ScreenSharing
      • Advanced JumpLists/RecentDocs Analysis
      • Amcache/Syscache/RecentFileCache Analysis
      • Activities Cache Analysis
      • SRUM (System Resource Usage Monitor) Analysis
      • Volume Shadow Copies (VSS) Analysis
      • $INDX ($i30 Index Attributes) Analysis
      • Process and Memory Dump Analysis (Kernel Live Dump, RAM Dump)
      • YARA Rules
      • File Entropy Analysis
      • Detect It Easy (DiE)
      • Velociraptor
      • Magnet EDD (Encrypted Disk Detector)
    • Common Bypass Techniques in ScreenSharing
      • Introduction to Bypass Categories
      • Concealment and Obfuscation
        • Spoofed Extensions
        • Unicode Characters in File Names/Paths
        • Alternate Data Streams (ADS)
        • Code Obfuscation
      • Steganography
      • Artifact and System Manipulation
        • Timestamp Manipulation (Timestomping)
        • Hexadecimal File Modification (Hex Editing)
        • Attribute Manipulation (Read-Only)
        • Service Thread Suspension
        • Command Prompt (CMD) Obfuscation
        • Disabling System Features via Registry/Group Policy
      • Artifact Clearing Techniques
        • Prefetch Clearing
        • Registry Clearing (BAM, RecentDocs, etc.)
        • USN Journal Clearing
        • Event Log Clearing/Manipulation
        • Recycle Bin Clearing
        • File Replacement (Replace Method)
      • Permission and Inheritance Modification
        • Using cacls (or similar) for Permission Changes
        • Disabling Registry/Folder Inheritance
      • Disk Partition Manipulation for Evasion
        • Mechanism of Evasion
        • Forensic Implications
      • Task Scheduler Bypass Techniques
        • Mechanism of Evasion
        • Detection
      • Scripting Languages for Evasion
        • Mechanisms of Evasion
        • Forensic Implications
      • Fileless Malware and Living-off-the-Land Binaries (LOLBins)
        • Mechanisms of Evasion
        • Forensic Implications and Detection
      • COM Hijacking
      • Shellcode Injection
      • Powershell Remoting
      • Suspicious DLLs and DLL Injection Techniques
      • Process Hollowing
      • Unsigned / Fake Digital Signatures
      • Environment and Hardware Bypasses
        • External USB Drives (FAT32 vs. NTFS):
        • Virtual Machines (VMs):
        • Cloud Storage (OneDrive, Google Drive, etc.):
    • Ban Evasion and Alt Account Detection
      • Understanding Ban Evasion
      • Identifying Alternate Accounts During ScreenShare
      • Reviewing Ban Policies
      • Importance of Documentation and Evidence
  • ScreenSharing Minecraft Knowledge
    • Minecraft Architecture and Analysis
      • Minecraft and Java
        • Minecraft Architecture (Java, JVM)
        • Launchers (Official, Custom: Lunar, Badlion, etc.)
        • .minecraft Folder (Location, Structure)
        • Categorizing Minecraft Cheats (Context for Analysis)
      • Specific Analysis for Minecraft
        • Forge Mod Analysis
        • Javaedit - Detection via Hash/Content
    • Mouse, Macro, and Input Analysis
      • Understanding Mouse Input Manipulation
      • Macro Analysis
        • Definition and Purpose in Cheating
        • Detecting Software-Based Macros
        • Detecting On-Board Macros
      • Debounce Time Analysis
        • Definition and Mouse Abuse
        • Server Rules Context
        • General Detection Strategy
        • Detection by Mouse Brand
  • ScreenShare Tools
    • Spok's Tools
      • Paths Parser
      • BAM parser
      • Prefetch Parser
      • Kernel Live Dump Analyzer
      • Replaceparser
      • JournalTrace
      • pcasvc executed
      • ActivitiesCache execution
      • process-parser
      • Spokwn Powershell Scripts
      • Streams Script
      • ActivitiesCache Script
    • Rancio's Tools
      • Tools
    • Echo's Tools
      • Tools
    • Specific PowerShell Scripts
      • Main RedLotus Scripts
  • Automatic ScreenShare Tools
    • coming soon
Powered by GitBook
On this page
  1. ScreenSharing General Knowledge
  2. Windows Fundamentals

File Systems: The Foundation

File System (Definition, Types: NTFS, FAT32, etc.)Journaling (Definition, Purpose)
PreviousWindows FundamentalsNextFile System (Definition, Types: NTFS, FAT32, etc.)

Last updated 2 months ago