Hi everyone,

I’m currently tasked with a forensic internal investigation regarding a former system administrator. We have clear evidence that they granted themselves excessive permissions in AD before leaving, but we are struggling to find "smoking guns" for specific actions.

The Situation:

• Privilege Escalation: We found unauthorized high-level groups assigned to their account in AD.

• Allegation 1: Accessing sensitive payroll/HR servers (Dxxx/Accounting software).

• Allegation 2: Copying a shared management drive (the "big one" for the board).

What I’ve tried: I've run several PowerShell scripts to parse Event Logs (4624, 4663, etc.) and generated some HTML reports, but the results are inconclusive or "too clean."

My Questions:

1. File Copying: Since Windows doesn't log "copy" actions by default (unless Object Access Auditing was enabled beforehand), what other artifacts should I look for? (USN Journal? ShellBags? Prefetch?)

2. Dxxx/Server Access: How can I distinguish between "routine maintenance" and "unauthorized data viewing" on an application server if the admin had valid (though self-assigned) credentials?

3. Lateral Movement: Are there specific Event IDs or registry keys that often get overlooked when an admin is "poking around" where they shouldn't be?

Any advice on forensic tools (FLARE VM, Eric Zimmerman's tools, etc.) or specific techniques to prove data exfiltration would be greatly appreciated. I want to remain objective and follow the facts.

Thanks!