CyberCode Academy

Course 36 - Windows Forensics and Tools | Episode 5: Structure and Forensic Significance

Listen Later
In this lesson, you’ll learn about: Windows Security Identifiers (SIDs) and user tracking1. What is a Security Identifier (SID)?
  • A SID (Security Identifier) is a unique value assigned to every:
    • User
    • Group
    • Security principal (system accounts, services)
🔹 Core Idea
  • It acts like a permanent digital fingerprint in Windows
  • Used internally instead of usernames
👉 Key Property:
  • A SID is never reused, even if the account is deleted
2. Why SIDs Exist
  • Windows needs a stable way to identify identities
  • Usernames can change
  • SIDs cannot
🔹 Example Use
  • Permissions are assigned to SIDs, not names
  • Access control checks rely on SID matching
3. SID in Access Tokens🔹 What happens at login?
  • Windows creates an access token
  • This token contains:
    • User SID
    • Group SIDs
    • Privileges
👉 Key Insight:
  • Every process inherits this token
  • This determines what the user can do
4. Structure of a SIDA SID is not random—it has a strict format:🔹 Main Components
  • Identifier Authority
  • Sub-authority values
  • Relative Identifier (RID)
5. SID Breakdown Explained🔹 Identifier Authority
  • Defines the system or domain origin
  • Example:
    • Local machine
    • Domain controller
🔹 Sub-authorities
  • Represent hierarchical security structure
  • Provide organizational uniqueness
🔹 Relative Identifier (RID)
  • The most specific part
  • Identifies the actual account
6. Important RID Examples🔹 Common Built-in Accounts
  • 500 → Built-in Administrator
  • 501 → Guest account
  • 512 → Domain Admins group
  • 513 → Domain Users group
🔹 Special Group
  • “Everyone” group → universal access SID
👉 Key Insight:
  • RID tells you exactly what type of account it is
7. How SIDs Are Used in Security🔹 Access Control
  • File permissions are assigned to SIDs
  • Not usernames
🔹 Authentication Flow
  • Login → SID loaded → permissions applied
8. Forensic Importance of SIDs🔹 What investigators can learn
  • Which user performed an action
  • Whether an account was deleted or renamed
  • Privilege escalation attempts
🔹 Why it matters
  • Even if usernames change, SID stays the same
  • Enables long-term tracking of user behavior
Key Takeaways
  • SIDs are permanent unique identifiers in Windows
  • They are used instead of usernames for security decisions
  • Stored inside access tokens during login
  • Structured into authority, sub-authority, and RID
  • Essential for forensic tracking and access control
Big PictureSIDs help you:👉 Move from “who is the user?” → “what identity is truly behind the action?”Mental Model
  • Username → Human label
  • SID → System truth


You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
...more
View all episodesView all episodes
Download on the App Store
CyberCode AcademyBy CyberCode Academy