Series
Scheduled task fundamentals
5 posts in this series. Read them in order or jump to any one.
- Windows Scheduled Task Forensics: The Complete Guide
Scheduled task forensics end to end: task XML files, the TaskCache registry key, legacy .job files and event logs, and how to correlate them in a case.
- Where Are Scheduled Tasks Stored? Locations and Acquisition
Every place Windows keeps scheduled tasks: System32\Tasks, SysWOW64\Tasks, C:\Windows\Tasks and TaskCache, plus how to collect them with KAPE or Velociraptor.
- Windows Scheduled Task XML Explained, Element by Element
Read Task Scheduler XML like an investigator: RegistrationInfo, Triggers, Principals, Settings, Actions, and the zoneless local times in Date and StartBoundary.
- TaskCache Registry Forensics: Tree, Tasks and DynamicInfo
What the SOFTWARE hive's TaskCache key stores per scheduled task: Tree Id/Index/SD, Tasks values, DynamicInfo run times, Actions and Triggers blobs, the Hash.
- .job File Forensics: Legacy Tasks in C:\Windows\Tasks
How to read legacy .job files: MS-TSCH fixed and variable sections, triggers, the local-time last run SYSTEMTIME, and when .job files appear on modern Windows.