Digital Evidence and Computer Crime, 3rd Edition

Chapter 17

Digital Evidence on Windows Systems

Eoghan Casey

Contents

File Systems

Data Recovery

Log Files

Registry

Internet Traces

Program Analysis

Given the popularity of Microsoft Windows, digital investigators will encounter these systems as sources of digital evidence in the majority of cases. As a result of its prevalence, powerful commercial forensic tools have been developed to facilitate the forensic examination of Windows systems. Although these tools can be used by individuals with limited knowledge and experience to perform complex operations, they are not a substitute for knowledge and experience. In addition to being familiar with the tools and techniques for acquiring and examining digital evidence from a computer running Microsoft ...