Summary
In this chapter, we have discussed how to locate artifacts on a Microsoft Windows-based operating system to determine the subject’s culpability in the matter being investigated. You have learned about the different categories of artifacts and what actions of the user/system they represent. Using the knowledge you have gained from this chapter will allow you to quickly determine which accounts were active during the timeframe you are investigating and whether the incident involved a removable storage device. In addition, you have learned about the artifacts to analyze in determining whether a user had knowledge of a specific file or application. Finally, we have used several commercial and open-source forensic tools to access the artifacts. As a result, you now know how to find and analyze digital evidence found on a Microsoft Windows-based operating system.
The next chapter will deal with memory forensics.
