Drives and system folders

Start every investigation by knowing what normal looks like. A clean Windows drive has the same handful of top level folders everywhere.

PS C:\Users\analyst> Get-ChildItem C:\ -Force | Select-Object Mode, Name
Mode   Name
----   ----
d--hs  $Recycle.Bin
d----  PerfLogs
d-r--  Program Files
d-r--  Program Files (x86)
d--h-  ProgramData
d-r--  Users
d----  Windows
-a-hs  pagefile.sys

you should see h in the Mode column means hidden. ProgramData and $Recycle.Bin are hidden by default, which is why people forget to check them.

defender tip -Force shows hidden and system items. Without it, Get-ChildItem quietly skips them.

Software installed properly lives in Program Files. A program sitting in a user profile was put there by that user, or by something running as them.

PS C:\Users\analyst> Get-ChildItem C:\Users -Recurse -Filter *.exe -ErrorAction SilentlyContinue | Select-Object FullName
FullName
--------
C:\Users\l.ahmed\AppData\Local\Microsoft\OneDrive\OneDrive.exe
C:\Users\m.osei\AppData\Local\Microsoft\Teams\current\Teams.exe
C:\Users\m.osei\AppData\Roaming\SyncHelper\synchelper.exe
C:\Users\m.osei\Downloads\Invoice_8841.pdf.exe

you should see Four programs. OneDrive and Teams install per user by design. The other two need a closer look.

defender tip Some legitimate apps install into AppData. Judge by the publisher, the date and the name, not the folder alone.

Files created within minutes of each other are often one event. Sort the listing by the Modified column in the lab.

PS C:\Users\analyst> Get-ChildItem C:\Users\m.osei -Recurse -Force -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt '2026-10-14 09:00' -and $_.LastWriteTime -lt '2026-10-14 10:00' } | Sort-Object LastWriteTime | Select-Object LastWriteTime, FullName
LastWriteTime        FullName
-------------        --------
14/10/2026 09:12:40  C:\Users\m.osei\Downloads\Invoice_8841.pdf.exe
14/10/2026 09:13:02  C:\Users\m.osei\AppData\Local\Temp\~DF3A1.tmp
14/10/2026 09:14:11  C:\Users\m.osei\AppData\Roaming\SyncHelper
14/10/2026 09:14:11  C:\Users\m.osei\AppData\Roaming\SyncHelper\synchelper.exe
14/10/2026 09:38:20  C:\Users\m.osei\NTUSER.DAT

you should see The download at 09:12 is followed two minutes later by a brand new folder in Roaming holding a program.

The owner is usually the account that created the file. Filter the Owner column for each account and note anything outside that person's own profile.

PS C:\Users\analyst> Get-ChildItem C:\Users -Recurse -File -Force -ErrorAction SilentlyContinue | Group-Object { (Get-Acl $_.FullName).Owner } | Select-Object Count, Name

you should see Only m.osei and l.ahmed own files under C:\Users. l.ahmed's file in Public is shared on purpose.

For each suspicious file note the path, size, time and owner. Do not open or run anything on the live machine.

defender tip Times can be changed by malware. Back them up later with event logs and other evidence before you build a timeline on them.