December 2014
Beginner
200 pages
6h 8m
English
Microsoft Windows is the most widely used operating system in the world. Thus, digital forensic examiners must have an understanding of how artifacts are created in Windows and how they can be used to track a user’s activity. This chapter covers deleted data and artifacts such as restore points, metadata, the Recycle Bin, and more.
“You see, but you do not observe. The distinction is clear.”
—Sherlock Holmes in A Scandal in Bohemia