Investigating Windows Systems

Preface

I am not an expert. I have never claimed to be an expert, particularly at analyzing Windows systems. As I have done before, got to a point where I looked around at the materials I had written into blog posts, into various documents, and even in a hard copy notebook and on scraps of paper, and saw that I had reached a critical mass. At that point, once I had “stacked” everything up, I felt that I likely had too much for a blog post (definitely too much for Twitter), and should just put everything into a book.

Looking back, I really feel like I decided to write this book for a couple of reasons. First, all of my earlier books have included lists of artifacts to be analyzed and tools for parsing various data sources, but little in the ...