Chapter 8

Correlating Artifacts

So far throughout this book, each chapter has addressed some aspect of analysis of a Windows system, on a per-artifact basis. In most cases, artifacts are presented and discussed in isolation from other artifacts. Often it can be very instructive to provide examples of how various, apparently disparate artifacts can be correlated and used in combination to address a particular issue, and to complete a particular type of case.


HowTo; case study; correlation

Get Windows Forensic Analysis Toolkit, 4th Edition now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.