WAC 4.0.0

WAC 4.0.0 — Windows servers, the directory and websites

Servers

• Every generation from Server 2003 to 2025, and Server 2022 Core, collected by the same executables (WAC32 for Server 2003), each measured by the test cycle on the server itself. Artefacts absent from a version or from a Core installation are said so (CollectionStatus) instead of failing.
• Domain controllers: ntds.dit and its logs copied raw (no LDAP, no replication) and replayed in the working copy; every object, deleted ones included, linked values with their removal dates, replication metadata attribute by attribute, security descriptors (DCSync rights). The directory's secrets are neither read nor written: only a closed list of attributes is decoded.
• Group policies: SYSVOL read the same way — Registry.pol, scripts, scheduled tasks of the preferences, security template; a cpassword is flagged by its file, its value not written.
• Web servers: IIS, Apache and nginx found by their configuration and services — sites, pools, modules, access and error logs in UTC, each site's folder copied whole; SQLite accounts with their hash scheme; MySQL, MariaDB and PostgreSQL data folders collected.
• Roles: DNS (settings and plug-in DLLs, zones, debug log), DHCP (scopes and leases of dhcp.mdb, audit logs), Hyper-V (machines and their disks' paths), and User Access Logging (LogFiles\Sum): by role, account and address, who reached the server and on which days.

Security review

A full review of the 4.0.0 code before publication: 8 findings fixed, each with the test that catches it (forged NTFS index name written out of the exhibit store, .. of a web configuration read out of the collection, Apache Define chain exhausting memory, SQLite 3.54.1 with neither views nor triggers in a forged database, uncaught exception ending a collection unsealed, and smaller ones).

Fixes since the last measurements

• The shipped verification scripts (verify-exhibits, verifier-consigne) accept a file name holding a lone half of a UTF-16 surrogate pair (Server 2016 names its User Access Logging databases so): the PowerShell one called the exhibit unreadable, the Linux one refused the whole manifest.
• A conversion that cannot delete the previous working copy gives the real Windows error and the entry that holds, no longer a fixed "access denied".

Measured

Final series on 7 and 8 November 2026, WAC started from a USB key as in the field: Windows 11 605 checks; Server 2025 566, 2022 586, Core 2022 534, 2019 540, 2016 521, 2012 R2 505, 2012 497, 2008 R2 431, Server 2003 109; domain controller 2022 609. On 4 November, on that controller: 3,711 directory objects identical to Get-ADObject, 145,421 ntds.dit values identical to dissect.esedb. Manuals, validation, harmlessness and comparison files, and the article, in French and English.

Files

WAC.exe (x64), WAC32.exe (x86: XP SP1 to 8, Server 2003), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

Documentation (PDF, French and English, as on master at 9de6ea2)

User manual (documentation_FR|EN), testing guide (testing_FR|EN), validation (validation_FR|EN), harmlessness (harmlessness_FR|EN) and comparison (comparison_FR|EN) files, and the article (article_FR|EN_4.0). The documents were brought up to date after the tag (final series as reference result, every test harness described, ATT&CK coverage with User Access Logging and the DNS role: 476 of 479 techniques); the binaries are unchanged.

WAC 3.0.1

WAC 3.0.1 — fixes found by measuring 3.0.0 again

Fixes

• Process modules read without PROCESS_ALL_ACCESS. The Toolhelp module snapshot opened each process itself with full access (0x1FFFFF), measured under Sysmon on 42 processes. Each process is now opened with PROCESS_QUERY_INFORMATION and PROCESS_VM_READ only (0x1410) and its modules read through psapi; protected processes refuse it as before. WAC32 uses psapi.dll, present since XP.
• Local times of investigation.json in the suspect's time zone: the first operations and StartLocal (and ExtractionStart of the manifest) carried UTC labelled +00:00.
• Not enough space said as such. The conversion checks the room for the working copy before rebuilding it (it reported "invalid data" on a full disk); the collection's estimate counts the deleted files' budget.
• Only a server edition is said not validated by the test cycle; every client from XP SP1 to Windows 11 is.

Measured

Windows 11 full cycle: 553 checks, no failure; Vista (WAC32): process checks green. Comparison with KAPE and the EZ tools, trace measurement (registry read back offline) and every manual redone on 29 and 30 October 2026.

Files

WAC.exe (x64), WAC32.exe (x86, XP SP1 to 8), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

WAC 3.0.0

WAC 3.0.0 — major release

Every client Windows, from XP SP1 to Windows 11

• WAC32.exe, the 32-bit WAC built from the same sources, collects on Windows XP SP1 to Windows 8 x86; WAC.exe (x64) on the 64-bit versions.
• The formats of each version are decoded: Prefetch of XP to 8.1, ShimCache of XP, Vista, 7, 8.0 and 8.1, Amcache of 8 and 8.1, thumbnail caches and Thumbs.db, BITS queues before Windows 10, WMI repository and RDP bitmap cache of XP, XP firewall.
• An artefact table by Windows version: an artefact absent from a version is not collected; a source that should be there and is not is declared "expected but not found"; a format without a decoder is declared "not supported", never returned as an empty list.

Shadow copies read raw, without the VSS service

Hives, logs and files as each shadow copy kept them, read from the volume itself: no VSS service or API is used, nothing is written to the examined disk. What a shadow copy keeps and the volume no longer has is reported.

Deleted files

Recovered by raw reading, in three levels set in wac.yml: $MFT records, names left in directory indexes ($I30), and carving of PE, ZIP and PDF files in free space at their exact size; FAT and exFAT volumes too. Each recovered file goes into the sealed exhibit store with its SHA-256.

New artefacts

Windows Search index (Windows.edb), Sysmon (configuration, archives) and relocated event logs, PowerShell profiles, Entra ID, OneDrive, ETW files, Defender for Endpoint, firewall, boot and Intune traces. Their MITRE ATT&CK coverage is tabulated in the manuals.

Review and verification

• A code and security review of the whole project before this release: decoders, raw readers, exhibit store, scripts.
• The manifest's seal is printed at the end of the collection, to be written down in the report; verify-exhibits.ps1 -Seal / verify-exhibits.sh --seal hold the manifest against it. The PowerShell verifier works from PowerShell 4.
• --output and output: accept a plain folder name only: the collection stays on the medium WAC runs from.
• Full test cycles in VMs: Windows 11 and 8.1 with no failure, and XP, Vista, 7 and 8.

Files

WAC.exe (x64), WAC32.exe (x86, XP SP1 to 8), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh (French messages), raw_hive_test.exe, SHA256SUMS.

WAC 2.0.3

WAC 2.0.3 — bugfix release

Fixed: the fingerprints of a data file cited by an artefact were those of its working copy

With --binary, an artefact that cites a file — the files a Prefetch says its program loaded — gives that file's MD5, SHA-1 and SHA-256. For a document or a data file of the exhibit store, WAC read them in the file's working copy. The conversion changes some of those copies:

• a registry hive is replayed with its transaction logs. Its fingerprints were those of a content that never was on the examined machine.
• an ESE database (WebCache, SRUM) is replayed during the conversion, and was read before or after that change depending on the order of the artefacts. Two conversions of one collection then gave two different SHA-256.

A document or data file of the exhibit store now gets the fingerprints the manifest recorded when it was taken: those of the file as collected, the same from one conversion to the next. Executables are unaffected: the conversion never changes them.

The exhibit store is not affected. Converting a collection again with 2.0.3 (--convert=<folder>) gives the right fingerprints.

How it is checked

A new check of the test cycle confronts every file cited by a Prefetch with the manifest's SHA-256. On a Windows 8.1 test cycle run before the fix (on the development version 3.0, which also replays the search index), it fails: 3 cited files out of 970 had another SHA-256, and not the same one from one conversion to the next. After the fix, all of them match.

Files

Same as 2.0.2: WAC.exe (Windows 10 and 11, x64, standalone), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

WAC 2.0.2

WAC 2.0.2 — bugfix release

Fixed: wrong NT and LM hashes for every account of a SAM using the RC4 scheme

The SAM's hashed boot key is derived, in the RC4 scheme (revision 1 of the F value of SAM\Domains\Account), with a constant string holding twelve Q. WAC 2.0.0 and 2.0.1 had thirteen. The hashed boot key came out wrong, and so did the NT and LM hashes of every account. They were values of a valid look, written without any error.

The AES scheme of Windows 10 and 11 does not use that constant, and it was the only one confronted before. A SAM still using the RC4 scheme is affected: Windows 8.1 and earlier, and any machine whose SAM was not rewritten to AES.

The constant was settled on the real F value of a Windows 8.1 machine, not guessed: only twelve Q satisfy the checksum the structure carries.

Also fixed: the hash history in the RC4 scheme is decrypted with its own salts (NTPASSWORDHISTORY, LMPASSWORDHISTORY).

That checksum is now verified. A wrong boot key or constant gives no hash at all, rather than wrong ones.

The exhibit store is not affected: it holds the SAM and SYSTEM hives as collected. Converting it again with 2.0.2 (--convert=<folder>) gives the right hashes.

How it is checked

• On a Windows 8.1 machine, with this binary, three hashes are confronted with MD4 of known passwords. A test account's current hash and the previous one in its history match. So does an account created with a known password, and so does the empty-password constant.
• On Windows 11 (AES), the VM test cycle confronts the witness account's hash and history at every run.
• A new test program, sam_secrets_test, builds an F value encrypted and checksummed by an independent computation. It runs 5 checks, the first of which fails with thirteen Q.

Files

Same as 2.0.1: WAC.exe (Windows 10 and 11, x64, standalone), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

WAC 2.0.1

WAC 2.0.1 — bugfix release

Fixed: an entry of a hive's transaction log was dropped at each replay

A hive's sequence number is the number of the next log entry it expects, not of the last one it holds. WAC 2.0.0 treated the entry carrying that number as already applied, and skipped it. The replayed hive then read without any error, with keys and values missing.

The size of the loss depends on when the collection is taken. In steady state the skipped entry is small, and its pages are often written again by later entries. Minutes after a boot it is the largest one: 113 pages on the SOFTWARE hive measured, with 125 event channels absent and 28 % of the events rendered without their message, their provider missing.

Every hive collected with log entries not yet written to it lost one entry when converted with 2.0.0. The exhibit store is not affected: it holds the hive and its logs as collected. Converting it again with 2.0.1 (--convert=<folder>) gives the corrected registry artefacts.

Also fixed: after the replay, the hive's header now carries the sequence number following the last entry and the data size that entry announces, as Windows leaves it. An entry that grows the hive extends the file, and its pages are bounded by the size it announces.

How it is checked

• WAC's replay is now confronted at every test cycle with Windows' own recovery. The collected hive and its .LOG1/.LOG2 are loaded by reg load, and Windows replays them itself. That hive and the one WAC replayed are both walked whole: same number of keys and values (278 374 and 477 158 for SOFTWARE, 38 943 and 98 225 for SYSTEM in the 2.0.1 cycle), same SHA-256 over every key and value.
• A new test program, hive_recover_test, builds a hive and its logs one letter per page. It runs 11 checks, 4 of which fail on 2.0.0.

Files

Same as 2.0.0: WAC.exe (Windows 10 and 11, x64, standalone), wac.yml, verify-exhibits.ps1|.sh, verifier-consigne.ps1|.sh, raw_hive_test.exe, SHA256SUMS.

WAC 2.0.0

WAC 2.0.0 — Windows Artefacts Collector

Collect on the examined machine, convert elsewhere. WAC now either collects (--collect, the default) or converts (--convert=<folder>), never both: the examined machine is only read.

Highlights since 1.3.1

• 69 artefacts, each switched on or off by its own key in wac.yml: registry (whole SAM with NT/LM hashes and groups, BAM, UserAssist, ShimCache, Amcache, shellbags, USB devices, persistence, Defender settings, installed programs, known networks…), $MFT, $UsnJrnl, $LogFile, event logs with the text Windows renders, Prefetch, shortcuts, jump lists, SRUM, recycle bin, scheduled tasks, WMI, BITS, browsers (Chromium, Firefox, Internet Explorer and WebCache: history, downloads, sessions and closed tabs, favicons), Outlook and Thunderbird mail, thumbnail caches, RDP, Windows Timeline, search index, DPAPI master keys, FAT/exFAT volumes.
• Raw NTFS reading only, files longer than 260 characters included; executables authenticated in memory (Authenticode, Microsoft catalogs): authentic Microsoft binaries recorded by their fingerprints, any other copied.
• Sealed exhibit store: MD5, SHA-1, SHA-256, the eight NTFS dates and the MFT entry of every exhibit; checked before every conversion, never read or written again after the initial copy. Every operation in investigation.json, with the trace it is expected to leave and the time of each step.
• JSON output: typed values, UTC and the suspect's local time with the offset in force at each date, no empty field.
• No trace, measured under Sysmon against KAPE and Eric Zimmerman's tools: no file on C:, no registry value, no event in Windows' logs.
• Tested: 494 checks in an autonomous Windows 11 VM cycle, each against an independent source; values confronted with KAPE and eleven EZ tools.

Files

• WAC.exe — the collector (Windows 10 and 11, x64, standalone).
• wac.yml — the reference configuration, to keep beside WAC.exe.
• verify-exhibits.ps1|.sh (English), verifier-consigne.ps1|.sh (French) — recheck a collection's seal and every exhibit without WAC.
• raw_hive_test.exe — the raw-reading test program of the test bench.
• SHA256SUMS — fingerprints of the files above.

Documentation (FR and EN): doc/ in the repository — user manual, validation, harmlessness and comparison files.

1.3.1

WHAT'S NEW !!

• ➕ replace wcout by wprintf to present buffer effect when writing to console
• 🔥 fix error message in console

v1.3

WHAT'S NEW !!

• 🔥 refactoring wstring affectation
• ➕ hash md5 computing of all files presents in artefacts became an option for performance issues

COMMAND LINE

usage: wac [--dump] [--events] [ --md5] [--output=output] [--loglevel=2]
--help or /? : show this help
--dump : add hexa value in json files for shellbags and LNK files
--events : converts events to json (long time)
--md5 : activate hash md5 computing for files referenced in artfacts
--output=[directory name] : directory name to store output files starting from current directory. By default the directory is 'output'
--loglevel=[0] : define level of details in logfile and activate logging in wac.log

     loglevel = 0 => no logging
     loglevel = 1 => activate logging for each artefact type treated
     loglevel = 2 => activate logging for each artefact treated
     loglevel = 3 => activate logging for each subfunction called (used for debug only)

v1.2

What's New

• 🔥 complete reform logging system for debug
• 🔥 fix bug in events directory hierarchy
• 🔥 refactoring
• ➕ added modification date of registry keys for bams, mru, mru_apps, run, shellbags artifacts.
• ➕ hash for recent docs source and target, processes (if not system process) and jumplists

please take in account the loss in performance but the gain in stability.

New command line

usage: wac [--dump] [--events] [--output=output] [--loglevel=2]
--help or /? : show this help
--dump : add hexa value in json files for shellbags and LNK files
--events : converts events to json (long time)
--output=[directory name] : directory name to store output files starting from current directory. By default the directory is 'output'
--loglevel=[0] : define level of details in logfile and activate logging in wac.log

     loglevel = 0 => no logging
     loglevel = 1 => activate loggin for each artefact type treated
     loglevel = 2 => activate loggin for each artefact treated
     loglevel = 3 => activate loggin for each subfunction called (used for debug only)