Investigating remote access abuse: A forensic framework for analysing AnyDesk artefacts on windows OS

Remote access tools (RATs), such as AnyDesk, are increasingly used for both legitimate enterprise management and illicit activities, including fraud and data theft. This dual use poses unique challenges for forensic professionals in distinguishing lawful from harmful usage. Although recent studies have examined RATs’ artefacts, the scope has remained confined to independent artefact analysis with limited correlation and a lack of a structured investigative framework, not fully addressing AnyDesk’s various aspects. Therefore, this paper presents a systematic forensic framework purpose-built for AnyDesk-related incidents in Windows environments, highlighting its relevance for cyber investigations. We first analyse forensic artefacts produced by AnyDesk, including logs, registry keys, prefetch files, and volatile memory remnants. Then, through targeted data collection and correlation of system and browser artefacts, we reconstruct timelines of user and session activities. This methodology is validated via a case study modelled on a real-world incident of unauthorised access and data exfiltration, evaluated across multiple scenarios that vary in operating environments, execution modes, and acquisition timing. In addition, we present open-source and custom tools that were used to automate the forensic process and broaden artefacts coverage. Finally, we extend our discussion of the proposed framework to address potential implications in legal or ethical scenarios, as well as considerations for advanced prospects such as anti-forensics threats and AI-driven investigation. This research advances the emerging field of remote access forensics by providing professionals with a reliable and justifiable method for examining AnyDesk-related cases in both corporate and criminal settings.