Series
Scheduled task fundamentals
5 posts in this series. Read them in order or jump to any one.
- Windows Scheduled Task Forensics: The Complete Guide
Scheduled task forensics end to end: task XML files, the TaskCache registry key, legacy .job files and event logs, and how to correlate them in a case.
- Where Are Scheduled Tasks Stored? Locations and Acquisition
Every place Windows keeps scheduled tasks: System32\Tasks, SysWOW64\Tasks, C:\Windows\Tasks and TaskCache, plus how to collect them with KAPE or Velociraptor.
- Windows Scheduled Task XML Explained, Element by Element
Read a Task Scheduler XML file like an investigator: RegistrationInfo, Triggers, Principals, Settings and Actions, and the zoneless local times in Date and StartBoundary.
- TaskCache Registry Forensics: Tree, Tasks and DynamicInfo
What the TaskCache key in the SOFTWARE hive stores for each scheduled task: Tree Id/Index/SD, Tasks values, DynamicInfo run times, Actions and Triggers blobs, and the Hash.
- .job File Forensics: Legacy Tasks in C:\Windows\Tasks
How to read legacy .job files: the MS-TSCH fixed and variable sections, triggers, the local-time last run SYSTEMTIME, and when .job files still appear on modern Windows.