ScheduledTasks
Scheduled tasks (*.job and XML)
- 13 paths
*.jobSchedLgU.txt- Per-user data
- Version 1.2
- Eric Zimmerman, Reece394
Paths on disk
13 paths
References
8 links
- windowsir.blogspot.com/2009/09/parsing-job-files.html(opens in new tab)
- sans.org/blog/windows-scheduler-at-job-forensics(opens in new tab)
- forensicswiki.xyz/wiki/index.php?title=Windows_Job_File_Format(opens in new tab)
- forensafe.com/blogs/taskschd.html(opens in new tab)
- stmxcsr.com/persistence/scheduled-tasks.html(opens in new tab)
- cybertriage.com/blog/windows-scheduled-tasks-for-dfir-investigations/(opens in new tab)
- learn.microsoft.com/en-us/powershell/module/psscheduledjob/about/about_scheduled_jobs(opens in new tab)
- learn.microsoft.com/en-us/powershell/module/psscheduledjob/about/about_scheduled_jobs_troubleshooting(opens in new tab)