Investigating Desktop Wallpaper
14/09/2022 Wednesday
Windows operating systems offer users many personalization options. Changing the desktop background or wallpaper is among these options. Users can select a picture, slideshow of images, or even a solid color as a desktop background.
Digital Forensics Value of Desktop Wallpaper Artifact
The desktop background or wallpaper may not seem to hold any forensic value. However, getting the customized settings of a system can sometimes provide valuable insights.
Location and Structure of Desktop Wallpaper Artifact
Desktop wallpaper artifact is located at; HKEY_USERS\S-1-5-21-[User GUID]\Control Panel\Desktop
The registry key stores the path (in text format) for the image used as the wallpaper.
Analyzing Desktop Wallpaper Artifact with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to extract Desktop Wallpaper artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select WallPaper artifact:
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of the WallPaper artifact in ArtiFast.
WallPaper Artifact :This artifact contains information about the image set as wallpaper by the user.
- Wallpaper Image URL - The path or URL where the wallpaper image is.
For more information or suggestions please contact: ummulkulthum.wambai@forensafe.com
