Chapter 4

Windows Systems and Artifacts

Information in this Chapter

• Windows File Systems

• Registry

• Event Logs

• Prefetch Files

• Shortcut Files

• Windows Executables

Introduction

Like any operating system, Windows systems offer a wealth of artifacts. In the case of the Windows operating system, there may be a greater wealth of artifacts than on some other operating systems. As such, those artifacts are unique to the operating system. This chapter addresses and discusses a number of artifacts unique and specific to Windows systems.

Windows File Systems

Windows systems support two primary file systems: FAT and NTFS. “FAT” stands for “file allocation table,” and “NTFS” stands for “New Technology File System.” FAT file systems come in several ...

Get Digital Forensics with Open Source Tools now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial