Part 2:Windows OS Additional Artifacts
In this part of the book, we will continue to deep dive into additional useful artifacts during a forensic examination. In this part, we will learn how to identify evidence of execution and move on to tracking USB usage. Also, we will explore the power of browser artifacts and how they can aid in drawing conclusions from an incident. In the last chapter, we will focus more on unique artifacts stored within the Windows OS.
This part contains the following chapters:
- Chapter 6, Application Execution Artifacts
- Chapter 7, Forensic Analysis of USB Artifacts
- Chapter 8, Forensic Analysis of Browser Artifacts
- Chapter 9, Exploring Additional Artifacts